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ABSTRACT 

Several unintentional hypergolic fluid related spills, fires, and explosions from the Apollo Program, 
the Space Shuttle Program, the Titan Program, and a few others have occurred over the past several 
decades. Spill sites include the following government facilities: Kennedy Space Center (KSC), Johnson 
Space Center (JSC), White Sands Test Facility (WSTF), Vandenberg Air Force Base (VAFB), Cape 
Canaveral Air Force Station (CCAFS), Edwards Air Force Base (EAFB), Little Rock AFB, and McConnell 
AFB. Until now, the only method of capturing the lessons learned from these incidents has been “word of 
mouth” or by studying each individual incident report. Through studying several dozen of these incidents, 
certain root cause themes are apparent. Scrutinizing these themes could prove to be highly beneficial to 
future hypergolic system testing, checkout, and operational use. 

INTRODUCTION 

Hypergolic fluids are toxic liquids that react spontaneously and violently when they contact each 
other. These fluids are used in many different rocket and aircraft systems for propulsion and hydraulic 
power including: orbiting satellites, manned spacecraft, military aircraft, and deep space probes. 
Hypergolic fuels include hydrazine (N 2 H 4 ) and its derivatives including: monomethylhydrazine (MMH), 
unsymmetrical dimethylhydrazine (UDMH), and Aerozine 50 (A-50), which is an equal mixture of N 2 H 4 
and UDMH. The oxidizer used with these fuels is usually nitrogen tetroxide (N 2 0 4 ), also known as 
dinitrogen tetroxide or NTO, and various blends of N 2 0 4 with nitric oxide (NO). 

Several documented, unintentional hypergolic fluid spills and fires that occurred in support of the 
Apollo Program, the Space Shuttle Program, and several other programs from approximately 1968 
through the fall of 2010 have been studied for the primary purpose of extracting the lessons learned. Spill 
sites include Kennedy Space Center (KSC), Johnson Space Center (JSC), White Sands Test Facility 
(WSTF), Vandenberg Air Force Base (VAFB), Cape Canaveral Air Force Station (CCAFS), Edwards Air 
Force Base (EAFB), Little Rock AFB, and McConnell AFB. 

NASA Procedural Requirement (NPR) 8621.1 revision B was used as a classification guideline to 
establish the following mishap related definitions: 

Incident - An occurrence of a mishap or close call. 

NASA Mishap - An unplanned event that results in at least one of the following: 

a. Injury to non-NASA personnel, caused by NASA operations. 

b. Damage to public or private property (including foreign property), caused by NASA 
operations or NASA-funded development or research projects. 

c. Occupational injury or occupational illness to NASA personnel. 

d. NASA mission failure before the scheduled completion of the planned primary mission. 

e. Destruction of, or damage to, NASA property except for a malfunction or failure of 
component parts that are normally subject to fair wear and tear and have a fixed useful 
life that is less than the fixed useful life of the complete system or unit of equipment, 
provided that the following are true: 1) there was adequate preventative maintenance; 
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and 2) the malfunction or failure was the only damage and the sole action is to replace or 
repair that component. 


Proximate Cause - The event(s) that occurred, including any condition(s) that existed 
immediately before the undesired outcome, directly resulted in its occurrence and, if eliminated or 
modified, would have prevented the undesired outcome. The proximate cause is also known as 
the direct cause(s). 

Root Cause - One of multiple factors (events, conditions, or organizational factors) that 
contributed to or created the proximate cause and subsequent undesired outcome and, if 
eliminated or modified, would have prevented the undesired outcome. Typically, multiple root 
causes contribute to an undesired outcome. 85 

These definitions are utilized for the categorization of all the incidents discussed in this document 
even though some of them did not involve NASA. A summary of the categorizations can be seen in 
Appendix A. 

The discussions in this report are by no means intended to accuse or “point fingers” by placing 
blame where it may not be appropriate. The study of incidents and mishaps is crucial for the successful 
future of the space program. Prior to the discussion on the particular incidents, the following three sub- 
sections discuss properties of three hypergolic propellants. One must understand the physics and 
physiological effects of these chemicals before being able to study and understand incidents involving 
them. 

PROPERTIES OF NITROGEN TETROXIDE (N 2 Q £ ) 

Nitrogen tetroxide is a strong oxidizing agent that is used with the hydrazine family of fuels for 
rocket propulsion in the vacuum of space. It was accepted as the rocket propellant oxidizer of choice in 
the early 1950’s by the U.S.S.R. and the United States. N 2 0 4 itself is nonflammable, non-explosive, and 
does not exothermically decompose; however, when added to a fire it will increase the intensity of 
combustion and burning rate by providing an additional oxygen source to the air. 22 N 2 0 4 is highly 
corrosive and extremely toxic. N 2 0 4 is a liquid in equilibrium with nitrogen dioxide (N0 2 ) vapor: N 2 0 4 
(liquid) <-> 2N0 2 (vapor). This equilibrium favors the vapor with increasing temperature and/or decreasing 
pressure. This is reversible when conditions are opposite. N 2 0 4 is available in various “grades” ranging 
from pure N 2 0 4 (mixed oxides of nitrogen-0 or MON-O) to 25% NO (MON-25). 

When N 2 0 4 liquid or N0 2 vapor come into contact with the skin, eyes, or respiratory system, the 
oxides of nitrogen react with water to produce nitric acid (HN0 3 ) and nitrous acid (HONO) that typically 
destroy tissue. Together, these compounds oxidize the moist and flexible inner tissue of the alveoli sacs 
within the lungs when inhaled which can lead to build-up of fluid (edema) and in extreme cases, death. In 
non-mortal exposure cases, tissue may heal with scarring (in the location where the tissue was 
significantly exposed), leading to destruction of the small airways and air sacs. Survivors may have 
varying degrees of permanent restrictive lung disease with pulmonary fibrosis. 60 

N 2 0 4 and N0 2 also have several other unique properties. N 2 0 4 (N0 2 ) vapors are approximately 
three times heavier than air and liquid N 2 0 4 evaporates about five times faster than water at room 
temperature. The vapors of N 2 0 4 MON-3 (3% NO content) are normally reddish-brown in color, which is 
caused by the rapid vaporization of N0 2 . Liquid N 2 0 4 and its vapors will either detonate or deflagrate on 
contact with hydrazine fuels, amines, and alcohol. Ignition may also occur when N 2 0 4 comes into contact 
with wood, paper, hydrocarbon fuels, and some adhesives. A mixture of N 2 0 4 and halogenated solvents: 
carbon tetrachloride, trichloroethylene, perchloroethylene, etc., may produce a violent explosion. N 2 0 4 
MON-3 (the most commonly used N 2 0 4 ) has the following properties: 22, 29, 67, 83 

• Molecular Weight 92.016 

• Relative Vapor Density 1.58 
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N 2 0 4 and N0 2 also have several other unique properties. N 2 0 4 (N0 2 ) vapors are 
approximately three times heavier than air and liquid N 2 0 4 evaporates about five times faster than 
water at room temperature. The vapors of N 2 0 4 MON-3 (3% NO content) are normally reddish- 
brown in color, which is caused by the rapid vaporization of N0 2 . Liquid N 2 0 4 and its vapors will 
either detonate or deflagrate on contact with hydrazine fuels, amines, and alcohol. Ignition may 
also occur when N 2 0 4 comes into contact with wood, paper, hydrocarbon fuels, and some 
adhesives. A mixture of N 2 0 4 and halogenated solvents: carbon tetrachloride, trichloroethylene, 
perchloroethylene, etc., may produce a violent explosion (AIAA SP-086-2001 ). N 2 0 4 MON-3 (the 
most commonly used N 2 0 4 ) has the following properties (AIAA SP-086-2001; Hall; Rathgeber; 
U.S. DHEW): 


• Molecular Weight 

• Relative Vapor Density 

• N 2 0 4 + NO, % 

• Boiling Point (14.7 psia), °F 

• Freezing Point, °F 

• Vapor Pressure (77 °F), psia 

• Specific Gravity (77 °F) 

• Ignition Capability 

• Odor 

• Odor Threshold, ppm 

• Exposure limit, ppm 

• Density (77 °F & 14.7 psia), lb m /gal 


92.016 

I. 58 
99.5 
70.1 

II . 8 
17.4 
1.423 

Not flammable 
Bleach-like 


1 to 3 

3 (exposure limit for NASA) 
11.96 


PROPERTIES OF HYDRAZINE (N,H,1 AND MONOMETHYLHYDRAZINE (MMHt 


Monopropellant grade hydrazine (N 2 H 4 ) is the fuel used in the Auxiliary Power Units 
(APU) on the Space Shuttle Orbiters and the Hydraulic Power Units (HPU) on the Space Shuttle 
Solid Rocket Boosters (SRBs) to generate high pressure gas for hydraulic power of the orbiter’s 
aerodynamic surfaces and the SRB’s thrust vector control system. N 2 H 4 is also used on many 
spacecraft for monopropellant rocket propulsion systems (on the order of tenths to hundreds of 
pounds of thrust per rocket engine). To produce thrust, monopropellant rockets utilize a metal- 
based agent to catalytically decompose the N 2 H 4 into ammonia, nitrogen, and hydrogen. 
Propellant grade hydrazine contains about 98.5% pure N 2 H 4 with the remaining 1 .5% being 
primarily water. Aerozine 50 (along with N 2 0 4 ) was used for the first and second stages of the 
Titan II Intercontinental Ballistic Missile (ICBM) and Titan space launch vehicles including the 23G 
(a variant of the Titan II used for launching medium-sized spacecraft), IIIB, NIC, and IV. The Titan 
II, IIIB, MIC, and IV rockets used the largest quantities of hypergolic propellants per launch in the 
history of the United States rocket fleet (for the first stage approximately 1 3,000 gallons of N 2 0 4 
and 11,000 gallons of A-50 were used along with 3,100 gallons of N 2 0 4 and 1,700 gallons of A-50 
for the second stage). 

The Occupational Safety and Health Administration (OSHA) classify N 2 H 4 and its 
derivatives as a possible carcinogen (Rathgeber). When hydrazine or its derivatives come into 
contact with tissue, the exposed person will usually suffer from chemical burns unless the liquid is 
quickly rinsed off with water. N 2 H 4 and its derivatives are extremely toxic, highly flammable, and 
highly corrosive. “Hydrazines and their vapors explode on contact with strong oxidizers, such as 
N 2 0 4 , hydrogen peroxide, fluorine, and halogen fluorides. Additionally, they react on contact with 
metallic oxides, such as iron, copper, lead, manganese, and molybdenum to produce fire or 
explosion” (Hall). 

Hydrazine fires produce little to no smoke or colorful flames. N 2 H 4 has a tendency to 
react exothermically with or without an oxidizer present (the reaction increases the temperature 
thus increasing the reaction rate; this is also known as a thermal runaway reaction). Another way 
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to describe a hydrazine thermal runaway reaction is “...the rate of heat generation by the reaction 
exceeds the rate of heat removal from the system” (Benz). This process is directly related to the 
auto-ignition temperature, which decreases as pressure increases. The exothermic reaction can 
end in an explosion if one or more of the following conditions are met within the system 
containing the hydrazine: the reacting system is confined to a rigid volume, the reacting system is 
adiabatic or nearly adiabatic, the reaction rate increases with temperature, or if the hydrazine is 
subjected to rapid over-pressurization through “water hammer” (AIAA SP-085-1999). The 
following are properties of N 2 H 4 (Rathgeber; U.S. DHEW; AIAA SP-084-1999): 


• Molecular Weight 

• Boiling Point (14.7 psia), °F 

• Freezing Point, °F 

• Vapor Pressure (77 °F), psia 

• Ignition Capability 

• Auto-ignites in Air, °F 

• Ratio of Specific Heat (gas) 

• Odor 

• Odor Threshold, ppm 

• Exposure Limit, ppm 

• Density (77 °F & 14.7 psia), lb m /gal 


32.045 

237.6 

34.75 

0.96 

4.7 to 100% by volume in air 

437 (increases with decreasing pressure) 

1.19 


Ammonia; fishy 
2 to 3 

0.01 (N 2 H 4 and MMH exposure limit for NASA) 
8.38 


Monomethylhydrazine is the fuel used in the Orbital Maneuvering System and Reaction 
Control System (OMS/RCS) on the Space Shuttle Orbiters. Monomethylhydrazine, N 2 H 3 (CH 3 ), is 
similar to hydrazine, N 2 H 4 , with the exception that it contains a methyl group in its molecule in 
place of one hydrogen atom as shown in Figure 1 . Propellant grade MMH contains 98% pure 
N 2 H 3 (CH 3 ) with the remaining 2% being primarily water. MMH is not used for monopropellant 
rocket propulsion because the carbon formed in its decomposition contaminates the thruster 
catalyst bed. It is extremely toxic, highly flammable, and highly corrosive. MMH has greater 
compatibility with metals as compared to N 2 0 4 as a result of its corrosive properties. 


MMH (NsHatCHs)) Hydrazine fN?Hjl 



Figure 1: MMH and Hydrazine Molecule Models 


An MMH fire may have a slight yellow-orange tinted flame. As with N 2 H 4 , MMH can also 
react exothermically with or without an oxidizer present, but the reaction rate has been found to 
be much slower than N 2 H 4 . Studies have also shown that MMH vapor is much less sensitive to 
detonation as compared to N 2 H 4 (Benz). As a result of the molecular differences in comparison 
to N 2 H 4 , MMH has slightly different properties as shown below (Hall; Rathgeber; AIAA SP-085- 
1999): 

• Molecular Weight 46.075 

• Boiling Point (14.7 psia), °F 189.5 
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• Freezing Point, °F 

• Vapor Pressure (77 °F), psia 

• Ignition Capability 

• Auto-ignites in Air, °F 

• Ratio of Specific Heat (gas) 

• Odor 

• Odor Threshold, ppm 

• Density (77 °F & 1 4.7 psia), lb m /gal 


-62.5 

3.23 


2.5 to 98% by volume in air 

286 to 386 (increases with decreasing pressure) 

1.13 


Amine; fishy 
1 to 3 
7.27 


The vapor densities of all hydrazines are greater than air and the evaporation rate is 
approximately the same as water at room temperature. N 2 H 4 and MMH liquid at room 
temperature and pressure are clear and oily. N 2 H 4 and MMH are hygroscopic (they readily 
absorbs water); therefore, water is widely used as a diluting agent. A liquid mixture of 58% water 
and 42% N 2 H 4 or MMH by weight prevents ignition in an open air environment. A vapor mixture 
of 65% water and 35% N 2 H 4 or MMH is considered nonflammable in air (AIAA SP-084-1999). 


SUMMARY OF PERTINENT HYPERGOLIC FLUID PROPERTIES 


NASA follows a strict time weighted average exposure concentration limit for N 2 H 4 , MMH, 
and N 2 0 4 for personnel safety during vehicle and ground support system processing. “NASA 
Centers shall utilize OSHA PEL'S [Permissible Exposure Limit], Threshold Limit Values (TLV) 
issued by the American Conference of Governmental Industrial Hygienists (ACGIH)...”(U.S. 
NASA). From these two organizations, NASA established that the TLV for N 2 H 4 and MMH would 
be 0.01 ppm and 3 ppm for N 2 0 4 for a conventional 8-hour work day and 40-hour work week. 

The National Institute of Occupational Safety and Health’s Recommended Exposure Limit 
(NIOSH REL) ceiling (120 minute time weighted average) for N 2 0 4 is 1.0 ppm. Several NASA 
Centers have chosen to use this lower value (1 .0 ppm) for their oxidizer system processing for a 
conventional 8-hour work day and 40-hour work week. 

It may seem odd that with all these seemingly negative properties and the greater relative 
quantity of incidents and their severity when compared to other commodities, spacecraft 
designers still choose to use hypergols for propulsion systems. This is primarily due to the fact 
that hypergols are storable and stable (as long as they are contained properly), have a high 
specific impulse when used for propulsion, are stable to impact as long as there is no spark, can 
withstand the extremes of hot and cold which are present in the vacuum of space with fewer 
controls than cryogenic propellants, and can be frozen and then thawed without detrimental 
effects to their chemical properties or storage vessels since they contract when frozen. However, 
care needs to be taken when hypergols are frozen in tubing as this can lead to over- 
pressurization during thaw (depending on the thaw pattern in the tubing). This is why thermal 
control of tubing is very important in hypergol systems. 


SUMMARY OF HYPERGOLIC PROPELLANT SPILLS AND FIRES 

The following 46 sections give a short summary of 46 separate hypergolic propellant 
related spills, fires, and/or explosions between April of 1 968 and January of 201 0. The names 
and company affiliations of those involved in most of the incidents have been omitted out of 
respect for those involved. 

APOLLO 7 SPS N,Q 4 SPILL (APRIL 21, 1968. CCAFS LC-341 

On April 21 , 1968 on the mobile Service Structure of Launch Complex 34 (LC-34) at 
CCAFS there was an N 2 0 4 spill of approximately one to two gallons during a dry-run using the 
new servicing equipment for the Apollo Service Propulsion System (SPS). A boilerplate 
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Command and Service Module with a non-flight SPS was installed on the Saturn IB launch 
vehicle. A cutaway view of the SPS is shown in Figure 2. The mobile Service Structure is shown 
in reference to the LC-34 launch pad in Figure 3. The servicing dry-run was being completed in 
preparation for the scheduled October, 1968 launch of the first manned Apollo Program mission- 
Apollo 7 with the crew of Wally Schirra (Commander), Donn Eisele (Command Module Pilot), and 
Walter Cunningham (Lunar Module Pilot, even though there was not a lunar module on this 
mission utilizing a Saturn IB launch vehicle). 

The Apollo SPS hypergol loading ground support equipment (GSE) consisted of two six- 
wheeled, flat bed portable tanker trailers (one for oxidizer and one for fuel) that held heavy-walled 
storage tanks, control valves, and a control console. Prior to the loading operation, the trailer was 
staged approximately 200 feet from the base of the pad structure. The servicing GSE also 
included the portable servicing panels that were staged at the base of the LC-34 structure. These 
large panels (15 feet long, by 10 feet high, by 8 feet wide) contained pumps, valves, and electrical 
cabinets inside an enclosure. Portable air dilution scrubbers with liquid separators were also 
located at the base of the launch pad separate to the trailers. Each had three big fans to disperse 
the propellant vapor. Hard-line tubing carried the propellant up the launch pad structure. 
Flexhoses were connected to the hard-lines by flanges to transfer the propellant from the fixed 
structure to the mobile structure propellant delivery system, which consisted of a valve box with 
supply and return lines, a vacuum pump, and a crossover three-way valve. 


Main parachutes (3) 


Crew compartment 


Electrical power system 
radiator panels (8) 

Fuel cells (3) 

Reaction control 
thruster assembly 
(4 locations) 
Cryogenic oxygen and 
hydrogen storage tanks 

VHF scimitar antenna (2) — 

Environmental control system 
radiator panels (2) 


Docking mechanism 

Drogue parachutes (2) 
Side hatch 



Aft compartment 
(tanks/ reaction 
control engines, 
wiring, plumbing) COMMAND 
MODULE 


SERVICE 

MODULE 


Helium tanks (2) 


Reaction control 
system assembly 
(4 locations) 


Service propulsion 
system tanks (4) 

Service propulsion 
engine nozzle 


High -gain (deep space) antenna 


Figure 2: Apollo Command Module and Service Module 
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Figure 3: LC-34 Launch Pad and Service Structure (In Park Position) 


The N 2 0 4 spill occurred when a vacuum was applied to the Command Module Reaction 
Control System (RCS) propellant tank prior to the second dry-run servicing test. It was later 
determined that a quick disconnect (QD) servicing valve had become blocked during the initial 
dry-run test (proximate cause). When the vacuum pump was brought online for the second dry 
run, oxidizer was pulled into the pump’s oil sump and then subsequently released out of the oil 
sump tank vent port. Technicians used the standard procedure at the time, which was to dilute 
the propellant using water. This, unfortunately, resulted in the formation of nitric acid. 
Approximately 400 gallons of water were used to dilute the N 2 0 4 which ultimately ran down the 
side of the launch vehicle and into the instrument unit ring, as seen in Figure 4 in the Saturn IB 
cutaway view. 

The damage to the vehicle was extensive and the delay was several weeks. The 
cleanup on the ground level of LC-34 took several days. A de-stack was completed to remove 
the instrument unit ring for repair. Most of the wiring in the instrument unit was removed and 
cleaned. Four cables were replaced and five connectors were rebuilt. Three of the outside 
antennas were also replaced along with the Saturn IB fin #4 and liquid oxygen bay three door. 
The forward skirt was removed from the Saturn IV B segment to allow for access inside the 
launch vehicle. The primary concern for the vehicle was long term corrosion. The vehicle design 
organization eventually became comfortable with proceeding to launch following several tests. 
This incident led to the following process and design changes: 

• Spill protection was used for all subsequent loading operations to contain and route 
spilled propellant away from the vehicle 

• “Scuppers” were attached to the vehicle to capture any spilled liquid 

o The scupper is a box that is attached to the vehicle servicing door that serves the 
dual purpose of spill containment and carrying the loads that the external GSE 
hoses place on the vehicle servicing valves and fluid lines 

• A requirement was also developed mandating that GSE designs be free of low point 
liquid traps 

• “Aspirators” that utilize a vacuum or eduction source routed to a toxic vapor scrubber 
were installed near servicing locations to allow for spill cleanup and containment 

• Following use, every QD was disassembled, cleaned, and all soft good were replaced 

o An inadequate maintenance plan was considered the root cause of this incident 

• All subsequent GSE tests were performed using a referee fluid such as Freon or alcohol 


7 




APOLLO SPACECRAFT 


INSTRUMENT UNIT 


SECOND STAGE 
(S-IVB) 



FIRST STAGE, 
(S-IB) 


Figure 4: Saturn IB Launch Vehicle 


References: Benson; Perez; Tribe 

APQLLO-SQYUZ ASTRONAUT N?0^ VAPOR EXPOSURE (7/24/1975. APOLLO-SOYUZ TEST 
PROJECT APOLLO COMMAND MODULE DURING RE-ENTRY) 

During reentry on July 24, 1975, following the Apollo-Soyuz Test Project’s nine-day 
international mission, Apollo-Soyuz astronauts, shown in Figure 5, Deke Slayton (front left), 
Thomas Stafford (back left), and Vance Brand (lower middle) were exposed to N 2 0 4 (N0 2 ) vapors 
for approximately four minutes and forty seconds. The estimated peak cabin concentration was 
approximately 750 ppm with an average crew exposure of 250 ppm. 



Figure 5: Apollo-Soyuz Test Project Crew 
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During reentry, the crew inadvertently performed a few tasks out sequence (root cause). 
The first task in the series was activating the Earth Landing System (ELS), which was a computer 
program that controlled several reentry activities on the vehicle. A crew member later reported 
that this activation was not performed because the other crew member had not heard the call out 
of the step as a result of communication system issue; however, the entire crew should have 
known that this step was missed as it was a critical step during reentry. 

The crew began to notice that events were occurring that did not coincide with their 
training. At approximately 23,000 feet, the drogue parachute was manually deployed. This 
activity caused the capsule to sway. The onboard guidance, navigation, and control computers 
sensed this motion and activated the Apollo Command Module’s RCS thrusters to counteract it 
(proximate cause). The crew knew that this was not supposed to happen and attempted to stop 
the thrusters from firing by closing the propellant isolation valves. This actually made the 
situation worse. 

Previously, at about 24,000 feet, cabin pressure relief valves began to gradually equalize 
the cabin pressure with the outside air as the external ambient pressure increased during the 
capsule’s descent. With these relief valves open and the propellant isolation valves closed, non- 
combusted N 2 0 4 (N0 2 ) vapors (that were boiling off within the propulsion system with the 
thrusters still trying to fire) were subsequently drawn into the capsule through the open cabin 
relief valves. A crew member then noticed that the main parachutes had not deployed as they 
passed through 1 1 ,000 feet. He then noticed that the ELS had not been activated. The crew 
member initiated the ELS and even though the computer had taken control, the crew member 
manually deployed the main parachutes. 


Brand describes the reentry events during the crew technical debriefing: 


“At 30K [30,000 feet], normally we arm the ELS AUTO, ELS LOGIC, that didn’t 
get done. Probably due to a combination of circumstance, I didn’t hear it called out, 
maybe it wasn’t called out. Any case 30K to 24K we passed through that regime very 
quickly. I looked at the altimeter at 24K, and didn’t see the expected apex cover come 
off. Didn’t see the drogues come out. So, I think at about 23K, I hit the two manual 
switches. One for the apex cover and also, the one for drogues. They came out. That 
same instant the cabin seemed to flood with a noxious gas, very high concentration it 
seemed to us. Tom said he could see it. I don’t remember for sure now, if I was seeing 
it, but I certainly knew it was there. I was feeling it and smelling it. It irritated the skin a 
little bit, and the eyes a little bit, and, of course, you could smell it. We started coughing. 
About that time, we armed the automatic system, the ELS...” 


The exposure greatly altered the astronauts’ abilities to complete assigned tasks in a 
timely manner; therefore, they experienced a very rough landing along with the poor luck of 
having the capsule splash-down in the “Stable 2” configuration, which meant it was inverted in the 
water and thus closed off from the outside air with the relief valves closed. Following splash- 
down, the crew was forced to don their oxygen masks, but in the interim before Stafford could 
retrieve and distribute the masks, Brand (who was sitting closest to the relief valve, see Figure 6) 
lost coconsciousness. 
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Figure 6: Apollo Command Module Interior Cutaway 


Stafford later reported: 


“For some reason , / was more tolerant to [the N0 2 vapors ], and I just thought get 
those damn masks. I said don’t fall down into the tunnel. I came loose and. . .had to 
crawl. ..and bend over to get the masks. . .1 knew that I had a toxic hypoxia. ..and I started 
to grunt-breathe to make sure I got pressure in my lungs to keep my head clear. I looked 
over at Vance [Brand] and he was just hanging in his straps. He was unconscious. ” 


Stafford climbed around the module to Brand and placed an oxygen mask over his 
mouth. With the oxygen mask in place, Brand regained consciousness within approximately one 
minute. The capsule was then reoriented upright and Stafford opened the vent valve, dissipating 
the remaining vapors. All three astronauts subsequently developed pneumonitis, for which they 
were hospitalized for about two weeks in Honolulu, Hawaii. All three recovered completely. Deke 
Slayton and Thomas Stafford did not fly on any subsequent space missions. Vance Brand went 
on to be the commander for three Space Shuttle flights: STS-5, STS-41 B, and STS-35. 


References: Ezell; Apollo (ASTP); Tribe 
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QV-101 APU 1 CAVITY SEAL N,H„ SPILL (6/28/1977. SECOND CAPTIVE-ACTIVE FLIGHT) 

On June 28, 1977, during Enterprise’s (OV-101) second captive-active flight with the 
crew of Joe Engle and Richard Truly, approximately five gallons of hydrazine leaked from APU 
number one’s cavity shaft seals and dumped overboard via the drain vent at the aft end of the 
vehicle. There was not a catch bottle in this early design. The incident resulted in a new design 
of the shaft seals and the addition of a catch bottle. 

The aerodynamic slipstream of the vehicle caused the hydrazine to be ingested into the 
left hand side of the aft fuselage through an access panel and vent door. There were no reported 
fires. There was extensive damage to the polyimide “Kapton” insulated wiring and interior 
thermal blankets near the left hand APU service panel from hydrazine exposure. There was also 
damage to the exterior thermal blankets. This incident seemed to bring to light the incompatibility 
between hydrazine and Kapton. For future flights, the left- and right-hand vent ports were 
modified to eliminate the possibility of ingestion. Also, the left and right access doors and T-0 
umbilical doors were sealed. The root cause of the leak was an inadequate understanding of the 
flight characteristics of the APU system. Finding these types of design faults are, however, the 
exact reason that flight tests are performed. 

References: Demarchi; Olney; Lance 

TITAN II SILO LARGE SCALE N,Q„ SPILL (8/24/1978, MCCONNELL AFB SILO 533-7) 

On August 24, 1978, at McConnell AFB southeast of Wichita, Kansas, the worst reported 
unintentional N 2 0 4 spill in U.S. history took place. Approximately 13,450 gallons of liquid N 2 0 4 
spilled into the underground missile silo. Two members of the 381 st Strategic Missile Wing were 
killed and 25 more were injured from N 2 0 4 liquid and vapor exposure. The silo also suffered 
extensive damage. The Titan II first and second stages were an A-50/N 2 O 4 bi-propellant 
propulsion system. The loading operations were completed using a holding tanker located above 
ground. Recall that N 2 0 4 (N0 2 ) vapors are heavier than air and they boil at approximately 70 °F 
at ambient pressure. 

Once the N 2 0 4 loading of the rocket’s first and second stages had been completed, all 
that remained was disconnecting the QDs from the rocket air half couplings (AHC). The 
technicians wearing Rocket Fuel Handler Coverall Outfits (RFHCOs) were unaware that a Teflon 
o-ring seal had dislodged from an upstream location, moved through the filter assembly (of which 
there were no filter elements installed), through the QD, and wedged itself in between the poppet 
of the AHC and its primary sealing surface on the Titan II (proximate cause) of the spill. This 
prevented the isolation of the bulk propellant in the first stage oxidizer tanks once the QD was 
removed. The RFHCOs were similar to SCAPE suits that are used by the Space Shuttle 
Program. When the technician mechanically separated the QD from the AHC, approximately 
13,450 gallons of liquid N 2 0 4 poured out of the AHC and into the missile silo. 

Very high concentrations of N0 2 vapors traveled from the silo into the connecting 
cableway to the blast lock area, which was located just outside of the control center where 
several personnel were located (see Figure 7). All the personnel located in the blast lock area 
managed to escape the vapors by exiting through the access portal at ground level. The 
personnel in the control center would normally be isolated from the silo; however, two technicians 
involved in the spill opened the airlock door to try and obtain assistance for their supervisor who 
was in need of immediate medical attention. The two technicians and four other control center 
personnel then evacuated through the emergency escape hatch, once they realized the 
immediate danger of the situation. The nearby town of Rock, Kansas had to evacuate about 100 
people as a result of the vapors that were escaping from the silo (see Figure 8). 

It was later discovered that the suit of the supervisor had failed, introducing him to 
dangerous levels of N 2 0 4 (N0 2 ) vapors, which was ultimately fatal to him within minutes of being 
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exposed (see section “Properties of Nitrogen Tetroxide (N 2 0 4 )” for a description of what N 2 0 4 and 
N0 2 does to the body). Two other technicians had removed their suit hoods while in the vapor 
cloud. One died nine days later. The extent of the injuries of the other technician is uncertain; 
however, he did survive. Repairs to the damaged 533-7 silo were attempted, but later 
discontinued for budgetary reasons. The silo was never returned to alert status. 



Figure 7: Underground Titan II Missile Complex 



Figure 8: Arial View of N 2 0 4 Vapor Cloud Coming from Missile Silo 533-7 

Lessons learned from this incident include the following: 
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• Proper configuration control of GSE components, in this case the filter, is highly important 
in the handling of toxic chemicals, especially hypergols (root cause of the incident) 

• Emergency procedures and safing must always be reviewed, practiced, and ingrained in 
the minds of personnel working with toxic chemicals 

• Procedural oversight may have been beneficial 

• Proper isolation of bulk propellant should be inherently designed into any rocket 
propulsion system and used accordingly during loading operations 

• Personal protective equipment (PPE) should be inspected prior to every use 

Reference: Rathgeber; Titan-ll.com 

N,H 4 SPILL FOLLOWING APU HOTFIRE (1 1/1979. KSC 0PF11 

In November of 1979, prior to the launch of STS-1 (Columbia), there was an N 2 H 4 spill of 
approximately two gallons during the propellant tank offload procedure in Orbiter Processing 
Facility 1 (0PF1). The spill occurred following an APU hotfire, which was performed as part of 
Columbia’s "dynamic stability" test to certify the vehicle for flight. APU hotfires were originally 
completed in the OPF using a vent that passed through the roof of the building to release the 
exhaust products. The source of the spill was found to be a leaking "gage saver" in the APU 
hydrazine servicing cart (proximate cause). It was discovered that the gage saver fittings had 
been replaced on the cart at Edwards Air Force Base (EAFB) following APU servicing for the 
Enterprise flight tests. The replacement gage savers were later determined to contain brass 
bellows, which were not compatible with N 2 H 4 (root cause). Following the shipment of the 
servicing cart to KSC, it was filled with N 2 H 4 at the Pad 39A fuel farm and then used for the 
servicing of Columbia in 0PF1 for the APU hotfire test. There were no reports of hardware 
damage or injuries. It is not certain, but this incident may have led to the practice of completing 
APU hotfires exclusively at the launch pad. 

Reference: Heinrich; Dougert 

TITAN II EXPLOSION FOLLOWING A-50 SPILL (9/18/1980, LITTLE ROCK AFB SILO 374-71 

On September 19, 1980, following a large A-50 spill the previous evening, the Titan II 
ICBM within missile silo 374-7 located about 2.5 miles south of Bee Branch, Arkansas, exploded. 
One of the 308 th Strategic Missile Wing’s airmen was killed and 21 other USAF personnel were 
injured as a result of the explosion and subsequent rescue operations. 

At about 6:30 PM on September 18, 1980, an airman was conducting a maintenance 
operation on level two (see Figure 9) of the underground silo when he accidentally dropped a 
large wrench socket. The standing platforms were hydraulically-controlled, flip-down structures 
with a rubber boot mounted between the platform and the rocket. The socket fell hitting the 
standing level two platform and bounced in the direction of the rocket where it slipped through the 
small gap between the rubber boot (which had become pliable over the years) and the Titan II 
rocket. It fell about 70 feet before hitting the thrust mount near the base of the rocket. The 
socket then bounced into and ruptured the stage one fuel tank (proximate cause). Approximately 
1 1 ,140 gallons of A-50 drained into the bottom of the silo. Fuel vapors heated up the silo and 
caused the pressures in the non-ruptured propellant tanks to rise substantially. 

At about 8:00 PM the control center was evacuated (see Figure 10 for a view of the 
launch silo and supporting facilities) and, therefore, the capability to remotely monitor the silo and 
rocket system data was lost. The entire missile complex and the surrounding area were then 
evacuated and a team of specialists that were knowledgeable of the Titan II rocket system were 
called in from Little Rock AFB (the missile’s main support base). Also, at around this time, local 
residents within a one-mile radius of the missile silo were evacuated. Local law enforcement 
officers closed the nearby State Highway 65, and alerted anyone entering the area. 
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Figure 9: Technicians Working on Fold-Down Platform in Titan Silo Level 2 

At 3:00 AM on the following morning (September 19, 1980) two people entered the 
control center in protective suits through the emergency escape hatch. They were forced to leave 
shortly thereafter as a result of the high fuel vapor concentration causing poor visibility. Prior to 
leaving, one of the men reportedly activated the exhaust fans which pulled the fuel vapors into an 
equipment area where some electrical pumps were located. It is assumed that this is where the 
fire originated, however this was never completely proven. It is unclear if the men received 
orders from a superior officer to activate the exhaust fans or not. Following the exhaust fan 
activation, the two men went back to the surface and had just paused to await further instructions 
when the Titan II rocket exploded, sending an earthquake-like shockwave across north central 
Arkansas. The heat from the flames at the base of the silo increased the temperature at the 
lower end of the rocket. This eventually led to the rupture of the N 2 0 4 tank, which reacted 
hypergolically with the spilled fuel causing the explosion. One of the two men died later that day 
in the hospital (once he was located among the rubble from the explosion). The other man was 
thrown approximately 150 feet from the silo and suffered only a broken leg along with several 
cuts and bruises. 

It was reported that the explosion blew the 740-ton reinforced concrete and steel silo 
door (see Figure 10 for a depiction of the Titan II missile silo) 200 feet into the air and 600 feet 
from the silo. The rocket’s second stage, with the W53 thermonuclear warhead attached, was 
launched out of the silo following the explosion of the first stage. The second stage then 
supposedly blew up in midair, (it contained about 1,730 gallons of A-50 and 3,120 gallons of 
N 2 0 4 ) sending the undetonated warhead several hundred feet from the silo. The W53 warhead 
had a mass of 8,136 lb and a yield of 9,000 kilotons (the Hiroshima bomb “Little Boy” was 
estimated at about 1 5 kilotons). Luckily the warhead’s safety features operated as they were 
designed. There was no reported loss of radioactive material. 
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Figure 10: Titan II Missile Silo 

The 374-7 Titan II missile silo complex was completely destroyed. The estimated value 
of the silo in 1980 was approximately $225,000,000. In October of 1981, President Reagan 
announced that all of the Titan II ICBM launch sites across the United States would be 
deactivated by October of 1987. Along with this action being part of the strategic modernization 
program, the deactivation was related to this incident and the previously mentioned incident at 
McConnell AFB. Silo 374-7 was the first Titan II silo to be deactivated. The 308 th strategic 
missile wing was completely deactivated on August 18, 1987. 
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Some lessons learned and corrective actions from this incident include: 


• All workers should wear a belt with lanyards to attach tools 

o Operational human error is, therefore, the root cause 

• Cloths should be placed on the platforms to prevent tools from bouncing off the metal 

• The Titan II missile silo platforms should be renovated to increase safety 

• The training and qualification program was insufficient prior to the incident (a root cause) 

• Communication with local authorities was inadequate, especially with reference to the 
nuclear warhead 

• Care should be taken to ensure the exclusive use of explosion proof hardware in a facility 
that contains hypergolic propellants 

o It is unclear if this incident was indeed caused by activating the exhaust fans; 
however, this is a still viable corrective action 

• Sending personnel into an unknown situation is extremely dangerous, especially one in 
which an explosion is imminent as a result of the high concentration of fuel vapors 


References: Hartsell; Titan-ll.com; Titan II Missile Explosion 


KSC INCORRECT FLIGHT CAP N?0/i VAPOR RELEASE (JULY 1981, KSC 0PF1) 

On roughly July 14, 1981 in 0PF1, there was an inadvertent release of N 2 0 4 (N0 2 ) 
vapors during the MD338 flight cap installation procedure. The cap was removed from MD338 on 
June 15, 1981 and routed to another facility with a fume hood for refurbishment. During the 
refurbishment procedure the incorrect part number (MC276-001 8-241 1, a /4-inch flight cap, see 
Table 1 for a description of the numbering nomenclature) was recorded for the cap and a parts 
tag with the incorrect number was attached. The correct part number was MC276-001 8-281 1 (a 
!4-inch oxidizer flight cap, shown in Figure 11). There had been issues with oxidizer flight caps 
becoming corroded; therefore, a problem report (PR) was generated to clean the caps. During 
the cleaning procedure the part number that was etched onto the cap was sanded off and all that 
was left to identify the cap was the attached parts tag (which was incorrect). 


Table 1: General Information on the MC276-0018 Air Half Coupling 


Coupling Size 
(in.) 

Poppet Area 
(in. 2 ) 

Force to Open 
(lbs) 

Force to Open 
(psid) 

Poppet Travel 
(in.) 

'A 

0.709 

9.50 

13.40 

0.034 

y 2 

1.131 

14.00 

12.38 

0.053 

1.00 

2.193 

14.80 

6.75 

0.139 


MD276-001 8-XXXX 

When this is a “4” the AHC tube size is %-inch OD 
. When this is an “8” the AHC tube size is /4-inch OD 
When this is a “6” the AHC tube size is 1 .00-inch OD 
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Figure 11: Fairchild Vi-inch Flight Cap 


During the MD338 flight cap installation procedure, on roughly July 14, 1981, the work 
step correctly called for the installation of a Vi-inch cap (part number MC276-001 8-281 1 ) onto the 
AHC. The cap that was staged for installation was the misidentified %-inch cap. When a 14-inch 
cap is placed onto a Vi-inch AHC, the dimensions of the stem allow for the actuation of the Vi-inch 
AHC poppet (reference Figure 30 for an illustration of this) if the proper force is applied to the cap 
and poppet. This is exactly what happened. An oxidizer vapor release was reported when the 
technician tried to install the 14-inch cap (proximate cause). The root causes are human error, 
improper configuration management, and improper vehicle design. The original flight cap design 
should not have enabled this type of incident to occur. The technician received minor injuries 
from exposure to N0 2 vapors. Close attention needs to be paid to the identification of flight caps 
and other hardware to prevent an event like this from occurring again (which it does on November 
4, 1992 atWSTF). 

References: Wilder (LO-JW-81 -010); Craig 

MMH EXPOSURE FOLLOWING FLEXHOSE REMOVAL AT PAD FARM (7/14/1981. KSC PAD 
39A FUEL FARM) 

On the morning of July 14, 1981, a technician was exposed to MMH liquid and vapors 
while removing an improperly labeled GSE flexhose from a panel at the Pad 39A (Space Shuttle 
and Apollo Program launch pad, along with 39B) fuel farm (proximate cause). The liquid MMH 
sprayed onto the technician’s arm and face, which he immediately attempted to wash off with 
water. The technician then reported to his supervisor who instructed him to wash his arm and 
face again, thoroughly, and formally report the incident. 

Upon investigation, it was found that the flexhose that was being removed was not 
labeled as hazardous. Proper labeling and configuration management guidelines were not 
followed (a root cause). The procedure had also not received a proper review by an experienced 
engineer (another root cause). The engineer that had been assigned to the procedure 
development task had delegated it to an engineer on loan from another facility and had instructed 
him to process the procedure as non-hazardous. Currently, procedures at KSC require a second 
review by a qualified engineer for hazardous GSE and vehicle operations. The technician was 
very lucky the carelessness in the procedure development and flexhose labels did not result in a 
more severe injury. 
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Reference: Wilder (LO-JW-81 -Oil) 

STS-2 QV-102 RIGHT POD MMH FIRE (FALL 1981. KSC OPF1) 


In the fall of 1981, a small amount of MMH (approximately a teaspoon) was spilled onto 
the gold multi-layer insulation (MLI) blankets in the right OMS pod (RV01) of Columbia (OV-102). 
Technicians unknowingly opened a line that contained a small amount of liquid MMH (proximate 
cause of the spill). Apparently, instructions had been given to the technicians to remove the 
blankets and install spill protection, but this was not completed and it was not incorporated into 
the procedure. The gold foil of the MLI blanket acted as a catalyst while the blanket batting 
absorbed and concentrated the released MMH. The cause of the fire was a result of the 
ventilated surface area (by aspirator) creating the correct conditions for combustion of MMH 
(proximate cause of the fire). The batting acted as an insulator effectively containing the heat of 
the reaction, transferring the heat back to the MMH, and allowing the temperature to increase to 
the boiling temperature of MMH (189.5 °F). Ignition of the blanket followed once the vapor fumes 
reached the auto-ignition temperature of MMH (382 °F). A technician used nearby flame 
retardant coveralls to extinguish the flames. 

It was later determined that MMH and gold are not compatible. The two root causes of 
this incident were operational human error and improper design (incompatible materials). Silver 
was later used, rather than gold, for thermal blanket construction. Note: in the past on other 
programs, the catalyst beds for mono-propellant thrusters contained gold until the material was 
switched to platinum. The gold was used for its high reactivity with hydrazine to support 
combustion in the thrusters. 

Reference: Houston; Heinrich 

STS-2 OV-102 N,CX, SPILL (9/22/1981. KSC PAD 39A 207-FOOT LEVEL) 

At 1:13 AM on September 22, 1981 an N 2 0 4 spill occurred at Pad 39A. The proximate 
cause of the spill was a failed ground half coupling (GHC), MD1 62, at the AP28-1 2 door (shown 
in Figure 1 2) on FRC2 of OV-1 02 (Columbia). Failure of the GHC was a result of iron nitrate 
build-up between the probe and the dynamic head of the GHC along with the tight tolerances of 
the GHC. See Figure 13 for a description of the AHC and GHC and also the failure location. 
Between 15 to 20 gallons of oxidizer was released into the attached scupper, which subsequently 
overflowed onto the vehicle. Damage to thermal tile adhesive resulted in the removal of 370 tiles 
(shown in orange in Figure 14). The photograph in Figure 15 shows the thermal tiles and the 
underlying vehicle structure along with the scupper and QD flexhoses going into the AP28-00 
door (second FRCS oxidizer servicing door just beneath the AP28-12 door when the vehicle is in 
the vertical orientation). 
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Figure 12: Drawing of AP28-12 Door and Failed MD162 GHC 
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Figure 13: AHC Closed and GHC Failed Open with External Leak Path Shown 

Confusion resulted in wasted time. Immediately following the spill, the proper alarms 
went off at the launch pad’s 207’ level; however, in the Launch Control Center (LCC), the 
engineers on console were unaware of the spill source until there was visual confirmation from 
the technicians (who were located outside the FRCS room and attired in SCAPE). Engineers on 
console executed the prewritten worksteps in the Operations and Maintenance Instruction (OMI) 
to safe the system once they realized the situation. Unfortunately, these steps did not include 
isolation of the QD from the GSE supply and the vehicle tank from the servicing interface; 
therefore, the leak continued until this was noted and resolved. 

The spill protection was not suitable for a large leak. It was incorrectly assumed that if a 
spill did occur; it would be small and containable within the spill protection. The spill protection 
still in use on the Space Shuttle Program over 27 years later is very similar to the “temporary” 
redesigned spill protection following the STS-2 N 2 0 4 spill. 


19 



•sy-'- 


Orbiter 

Windows 


83* K* 




Figure 14: Removed Tile from OV-102 Following STS-2 N 2 0 4 Spill 
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Figure 15: Photograph of AP28-00 Door and Orbiter Following the Spill 


The launch was delayed by about one month while repairs were made to the vehicle, 
which remained at the launch pad. Many of the thermal tiles were baked in an oven and 
reinstalled onto the orbiter, which is a standard procedure to remove the N 2 0 4 or N0 2 from 
thermal tiles when they become impregnated with oxidizer vapors. Several damaged thermal 
blankets located inside the forward module were replaced at the pad by accessing them through 
two doors adjacent to the orbiter windows. 

A committee was formed to investigate the spill and compile recommendations for 
improvements and lessons learned. The following is a summary of the lessons learned: 

• The GHC design was flawed in that there was a single point failure resulting in a leak 
path (a root cause) 

• The scupper and apron were not large enough to contain the spill 

• Using the GHC as a shut-off valve was flawed engineering practice (another root cause) 

• The emergency procedure was inadequate 

• All entry paths to the FRCS module should be sealed during servicing 

• Care must be taken in the control of iron nitrate which is always present in an N 2 0 4 
system 
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o Iron nitrate and its impacts to hardware were not well understood in 1981 

• Proper ventilation and lighting should be added to the FRCS room on the 207-foot level 
of launch pads 39A and 39B 

• Emergency Launch Processing System (LPS) programs could have saved time during 
safing 

• The communications system could have been used more efficiently 

Corroded structural components that had been exposed to oxidizer vapors were later 
found in the internal portion of the FRCS module. It is believed that the vapors entered the 
forward module through small test ports located at the external doors. Many years later it was 
also found that the oxidizer vapor reacted with several electrical connector backshells within the 
FRCS. 


A large amount of knowledge was gained from the spill. There were many process and 
GSE design changes implemented following the recommendations from the Mishap Investigation 
Committee Report. The following is a list of what was completed: 

• Additional GSE valves were added to isolate the liquid N 2 0 4 rather than using the QDs as 
valves 

o GHCs were subsequently no longer used as shut-off valves during loading 

• The scuppers were upgraded through a redesign 

• The QDs and AHCs were found to have very tight tolerances; therefore, the poppets 
were subsequently electropolished to open the tolerances 

• An improved maintenance plan was implemented for the GHCs 

• Improved local emergency procedures were implemented 

• Entry paths to the FRCS module were blocked with tape and RTV (adhesive) 

• Improved controls were put in place to minimize the amount of iron nitrate in the liquid 
N 2 O 4 (by reducing the iron and water content in the propellant) 

• The lighting in the FRCS room was enhanced 

• LPS improvements were made including automatic remote safing that was keyed from 
local toxic vapor detection devices 

Reference: Williams; Heinrich; Tribe 

PAD 39A FUEL FARM MMH SPILL AND FIRE FOLLOWING PNEUMATIC VALVE R&R 
(6/29/1982, KSC PAD 39A FUEL FARM) 

On June 29, 1 982 (a hot summer day with a high of 90 °F), at the Pad 39A fuel farm, 
there was an MMH spill and fire during the removal and replacement of a pneumatically 
controlled valve. Figure 16 and Figure 17 are photographs taken following the fire. Prior to the 
removal and replacement of the valve, the farm was powered down and the GN 2 valve control 
pressure was removed to enable the removal of the control pressure tubing on the pneumatic 
valve. When this pressure was removed, a few valves that were intended to remain closed, went 
to open (the valves were normally open valves with the pressure removed). This was the 
proximate cause. The change in valve positions went unnoticed or was ignored by the engineers 
on console. 

Immediately following the removal of the valve a small amount of fuel vapor was released 
from the open line. About a minute later, a 12- to 48-inch geyser of MMH was released from the 
open line and splashed onto a metal cable tray above and ignited either as a result of the hot 
metal or by some local iron oxide (rust). It was estimated that approximately 15 to 25 gallons 
spilled from the line. The engineer located in the LCC could not see the events as they occurred 
as a result of having a view from the Pad 39A oxidizer farm camera on his closed circuit television 
(OTV) screen, which is located approximately 1 ,800 feet from the fuel farm. 
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The technicians reported the spill and immediately evacuated the farm to the camera 
embankment south of the fuel farm, removing themselves from the communications loop in the 
process. Once there, they awaited the SCAPE pickup van. The farm firex was then activated 
remotely by the duty officer, extinguishing the fire. The technicians reported that they were 
unable to reach the firex controls as a result of the flames. No one was injured in the spill and 
fire; however, there was a notable amount of damage to the GSE at the fuel farm as seen in 
Figure 16 and Figure 17. 

Following the fire, manual overrides were added to the liquid return isolation valve and 
the storage tank isolation valve, which cycled normally open when control pressure was removed. 
Improper GSE design was one root cause of this incident. It was also found that when the 750 
psig GN 2 supply pressure was vented in preparation for the valve removal, the toxic vapor 
aspirator lost its pneumatic supply pressure. A pneumatic actuation valve and vent valve were 
added to the GSE at the propellant farms to better isolate the liquid MMH and the aspirator, 
respectively, when removing and replacing valves. Labels were painted in large letters on the 
farm roofs and sides of the propellant storage tanks to aid in the identification of the farms via 
OTV. Other findings related to this incident include the following: 

• The procedure was not written or reviewed by an experienced engineer prior to the task 

• The engineer on console was making changes to the procedure real-time while 
monitoring another task in parallel 

o Improper adherence to the procedure and the procedure approval process are 
also root causes of this incident 

• There was only one engineer on console supporting the hazardous operation 

o The engineer had to leave the communications channel to talk to the test 

conductor and in doing this missed some reports from the personnel at the fuel 
farm 

• There was not a charged water line nearby when the fire occurred 



Figure 16 : Photograph of Fuel Farm Following Fire 
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Figure 17: Separate Pneumatic Valve (Following Fire) 


References: Tribe (L0-JT-82-044); Utsman 

N,Q, VAPOR RELEASE FROM FLANGE GASKET (2/10/1983. KSC PAD 39A OXIDIZER 
FARM) 


During processing for the first flight (STS-6) of Challenger on February 10, 1983, there 
was an N 2 0 4 vapor release at the Pad 39A oxidizer farm. Technicians and engineers were 
working a decay and leak check procedure on the fluid distribution system. The engineer on 
console was bringing up the system pressure at the farm. While this was occurring, the 
technicians reported a large N 2 0 4 vapor release. They also later described hearing a loud noise 
during the pressurization. The engineer secured the GSE and reported that there was an 
emergency on the communications net. The oxidizer farm was cleared of all personnel and a 
SCAPE crew was sent in. The SCAPE technicians noted that a flange gasket on an isolation 
valve had blown out and was releasing N 2 0 4 (N0 2 ) vapors (proximate cause). There were no 
injuries since all personnel at the farm were located upwind from the vapor release. This incident 
seems to have been properly managed by the technicians and engineers; however, there may 
have been a design flaw in the GSE, which could be considered a root cause. 

Reference: Kamp 

FRCS FERRY PLUG REMOVAL MMH SPILL (4/18/1983, KSC OPF1) 

On roughly April 18,1 983, during the orbiter thruster ferry plug removal operation, liquid 
MMH spilled from two thrusters (F4D and LI L), wetness was noted in one (R1 U), and vapors 
were noted in another (R2D). These events occurred during turn-around operations following the 
arrival of Challenger at KSC via the Shuttle Carrier Aircraft (SCA) from the orbiter’s maiden 
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voyage (STS-6) and landing at EAFB. A technician was exposed to liquid fuel when the plug was 
removed from F4D (FRCS down firing thruster on manifold four). It was estimated that % to !4 of 
a cup spilled from the thruster. 

The liquid presence in the thruster chambers was likely a result of the fuel pilot operated 
valves leaking. These valves are sensitive to temperatures below 60 °F because the Teflon seals 
non-uniformly contract. Normally, the temperature was maintained above 60 °F using the thruster 
heaters; however, when the SCA and orbiter landed at KSC, the orbiter was not powered for 
about 36 hours. During this time period, the outside temperature dropped to a low of 
approximately 50 °F and remained below 60 °F for about nine hours. The following are lessons 
learned and corrective actions that were implemented following this incident: 

• Thruster heaters shall remain on during all ferry and post-landing orbiter operations 

• Ferry plug removal was upgraded from the current PPE level at the time to a SCAPE 
operation 

• The ferry plug relief valve shall be aspirated with the fuel aspirator prior to ferry plug 
removal 

o If there is any indication of oxidizer at the relief valve exit, the oxidizer aspirator 
shall be used for this operation 

The proximate cause of this incident was removing a thruster ferry plug without knowing 
that there was liquid fuel present behind it. The root cause was an improper operational 
understanding of the limitations and sensitivities of the thruster fuel valves. 

It was also noted in the corrective actions memo written by Mr. Tribe that it is less likely 
that the oxidizer thruster valves would leak since the Teflon seals swell by approximately 3% 
when exposed to N 2 0 4 at ambient temperature. The seals only swell by approximately 0.7% in 
the presence of MMH at ambient temperature. 

Reference: Tribe (L0-JT-82-043) 

STS-9 QV-102 APU-1 AND -2 EXPLOSION (12/8/1983, EAFB RUNWAY 1 70t 

On December 8, 1983, Space Shuttle Columbia landed at EAFB at 3:48 PM pacific local 
time, concluding the STS-9 mission. About seven minutes after landing, an unusual series of 
events occurred. First, APU-1 shut down prematurely in response to a sensed turbine 
“underspeed” condition. About four and a half minutes later an explosion occurred in the APU. 
Figure 18 shows what remained of the APU-1 fuel pump following the explosion along with the 
resulting collateral damage. At the instant of the APU-1 explosion, APU-2 spontaneously shut 
down. Fifteen minutes later it exploded. Figure 19 is a photograph of APU-1 and APU-2 in the 
aft of OV-105 (similar to the OV-102 configuration). APU-3 ran nominally. 

Failure analysis indicated that stress corrosion cracking of the injector tube created the 
leak into APU-1 ’s gas generator cavity (proximate cause). In the vacuum of space, the hydrazine 
froze in the cavity and remained stable throughout the orbital phase of the mission. However, 
when the vehicle started its re-entry, the hydrazine thawed, expanded, vaporized, and then 
eventually caused the gas generator to explode. The following is quoted from the Space Shuttle 
Mission Evaluation Room (MER) database: 

“Post-f light data review indicated that hydrazine leakage first occurred 
approximately 17 minutes after APU-1 and -2 were started for entry. This condition was 
indicated by valve-module cooling caused by hydrazine evaporation. The hydrazine 
accumulated in an ice state between the valve-mounting plates and the gas-generator 
radiation shield. As entry continued and the lower altitudes were reached, flash 
evaporation ceased, melting began, and the liquid hydrazine ran down on to the hot 
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turbine housing surfaces. The ambient pressure in the aft fuselage reached a level that 
would support decomposition at approximately 4 minutes and 30 seconds prior to 
landing. Hydrazine decomposition and subsequent release occurred as indicated by 
valve module heating approximately 4 minutes prior to landing for APU-1 and 2 minutes 
prior to landing for APU-2. Numerous instrumentation and electrical wires on both APUs 
were damaged by fire. The APU-1 shutoff valve electrical current was interrupted, 
closing the modulation valve which caused an APU underspeed condition. The system 
fuel isolation valve also closed, automatically isolating the APU-1 fuel supply. Residual 
heat from the fire, combined with normal heat soak-back, caused the modulation valve 
and associated tubing to overheat to approximately 500 °F. The trapped hydrazine 
explosively decomposed and the APU-1 modulation valve detonated. The detonation 
caused the APU-1 high-point bleed quick-disconnect poppet to be expelled through the 
flight cap and sent shock waves up the fuel line which detonated fuel vapor bubbles in 
the fuel pump cavity. Additional hydrazine was sprayed into the aft compartment at the 
time of APU-1 detonation as indicated by the splash pattern on the avionics bays. 
Apparently, the shockwave from the APU-1 detonation caused the already damaged 
wires on APU-2 to short, closing the modulation valve causing APU-2 to shut down. This 
resulted in an automatic isolation valve closure which isolated the APU-2 fuel supply. 

The residual heat from the fire combined with the normal heat soak-back to cause the 
APU-2 modulation valve to detonate resulting in a high-point bleed quick disconnect blow 
off and a subsequent fuel pump detonation. 

Inspection of the aft compartment at the APU-1 location revealed minor 
hydrazine splash in the area of the APU mounts and on top of the avionics bays. There 
was smoke and heat discolorations on the insulation and structure forward of the APU 
and on the exhaust duct above the APU. Minor shrapnel damage was noted. 

APU-2 had a splash pattern similar to APU-1, except more extensive. The 
smoke and heat discolorations were evident to a greater degree than on APU-1 and at 
locations higher above the APU. Also, minor shrapnel damage was noted. 

The tear-down and inspection of both APUs revealed that the damage was 
similar and limited to the fuel systems and wiring. Further inspection of the APU injector 
tubes revealed that both tubes were cracked circumferentially upstream of the thermal 
shunt. 


The APU stems had intergranular cracks from the inside diameter to the outside 
diameter for 225 degrees on APU-1 and 180 degrees on APU-2 around the 
circumference of the stems. All microstructure indicated intergranular carbide 
precipitation at the inside diameter. The most probable scenario describing the cause of 
the APU stem failure is as follows: 

During the manufacturing operations (braze cycle), a slow cooling of Hasteloy B, 
which is the APU stem injector material, from 2100 °F to 1100 °F resulted in carbide 
precipitation at the material grain boundaries. Additional carbon believed to be available 
from electro discharge machining of the stem bore diffused into the alloy during the 
brazing operations. A variance in cooling rate between the inside diameter and outside 
diameter during the braze cycle caused enhanced carbide precipitation near the inside 
diameter. The resultant microstructure was sensitized, which means that the corrosion 
resistance of the grain boundaries was reduced. The sensitized surface contacted an 
aggressive environment (hydrazine, air, moisture, carbon dioxide, ammonia) with attack 
accelerated at a region-of-stress concentration due to sustained stress levels (injector 
stem preload caused by manufacturing assembly misalignment). The crack progressed 
until stress levels and/or availability of corrodant changes allowed the fracture to finish 
under mechanical or thermal fatigue conditions. The most suspicious corrodant is 
carbazic acid. The above scenario is considered to be time dependent. The failure 
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mechanism is thought to be stress corrosion which requires a susceptible material, an 
available corrodant, and the presence of a sustained surface tensile stress level. 

The APU failures most probably resulted from a crack in the injector stem caused 
by corrosion of the sensitized inside diameter surface. The corrodant is probably 
carbazic acid or some similar substance which can be derived from air, moisture, C0 2 , 
hydrazine and/or ammonia. The corrosion is time dependent and the crack progressed 
under sustained stress levels from the inner diameter surface toward the outer diameter 
surface until mechanical or thermal fatigue conditions could [complete] the crack rupture." 



Figure 18: APU 1 Fuel Pump Explosion Following STS-9 



Figure 19: APU-1 and -2 in a Nominal Configuration 


27 






Following the STS-9 flight, several changes were made to the APU subsystem, including 
soaking of the carbon seals in hydrazine prior to installation, chromizing the injector stems to 
prevent corrosion, and minimizing stresses on the injector stems during manufacturing and 
installation. These design flaws are believed to be the root causes of the incident. 

Reference: MER Problem Report (STS-9) STS-9-V-26 

N 9 O 4 VAPOR RELEASE FROM LOOSE FITTING (2/17/1984, KSC OPF21 

On February 1 7, 1984 there was a small N 2 0 4 vapor release from a loose B-nut fitting in 
the GSE oxidizer vent line in OPF2. There were no injuries or hardware damage; however, OPF2 
was evacuated as a precaution. It was found that the contractor who originally installed the 
hardware was careless in their installation of several fittings, which were improperly torqued 
(proximate cause). Once OV-099 rolled out for flight from the OPF, all hypergolic, ammonia, and 
Freon vent system fittings were re-torqued and recorded. It was also found that butyl rubber 0 - 
rings were installed into some fittings. Butyl rubber is not compatible with N 2 0 4 . Following a 
detailed review of engineering drawings and historical records, all suspect fittings were removed 
and fittings with Teflon seals were installed. Improper configuration management was the root 
cause of this incident. 

The actual incident was not that noteworthy, but there were several improvements made 
to the GSE, configuration control and management, contractor oversight procedures, and OPF 
area warning system. It was found that there was not a proper system in place for a single bay 
evacuation (OPF1 and OPF2 are connected). The single bay clears to date had all been 
conducted through the area paging system, which most personnel in the processing bay either 
cannot hear or tune out as a result of the large quantity of pages that do not concern them. It was 
also discovered that once the bay had been cleared that it was impossible to know if everyone 
was out of the building. These two items resulted in an OPF area warning system with audible 
alarms (also known as “warblers”) and flashing lights along with the addition of a badge board 
outside the entrance to the bay where personnel are required to place their KSC badge prior to 
entering. This was a substantial improvement in safety. With the new area warning system, 
personnel were able to be notified in the case of a single bay evacuation or dual-bay evacuation. 
Also, following this incident, there was a strong emphasis placed on detailed contractor 
surveillance. Prior to the vapor release, outside contractors were allowed to install hardware 
without proper procedures and oversight. 

Reference: Bowman 

CCAFS TANKER MMH FIRE (5/16/1984, CCAFS FSA 1 ) 

On May 16, 1984, at Fuel Storage Area one (FSA 1) on CCAFS there was an MMH fire 
during a tanker offload operation. The 3,000 gallon tanker was being drained of its MMH to 
prepare it for transport of Aerozine-50. Approximately 60 gallons had been drained from the 
tanker into the facility storage system while the tanker was at a pressure above atmospheric. The 
tanker was then purged with GN 2 and vented to ambient to allow the technicians to disconnect a 
flange in the tanker sump (the tank’s low point). The flange removal opened the tanker to 
atmosphere for gravity draining of the residual MMH (about one to two gallons) into a stainless 
steel bucket below, which was being held by one of the technicians. When the flange gasket 
came loose from the tanker, the two technicians noticed the presence of heat on their hands and 
arms through their SCAPE suit gloves. One SCAPE technician declared that there was a fire 
over the communications network and on his way to the safety shower he activated the facility 
water deluge system. 

Once the SCAPE personnel were sure they had extinguished the flames on their suits, 
they evacuated the area to the south. Both had received minor burns on their hands and were 
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sent to a medical facility. It was later noted that both SCAPE suits showed signs of burning when 
they were examined following the incident. Shortly after the technicians entered the showers, two 
fire and rescue personnel who were waiting on standby, entered the area and aided the water 
deluge in extinguishing the flames with their charged hoses. It was reported that the fire was 
completely extinguished in about one minute. 

Following the incident, there was an extensive inspection of the tanker and surrounding 
areas. It was found that the fire was mainly concentrated around the shroud, which covered the 
sump flange, and the stainless steel bucket. An exact cause of the fire was unable to be 
determined; however, several possibilities exist. The following is a tabulated list of possible 
causes of the fire: 

• There was an extensive amount of corrosion (iron oxide) around the sump drain flange 

• The bucket was not properly inspected and cleaned of any possible iron oxides or other 
contamination prior to running the procedure 

• The bucket could have heated up from solar radiation (the weather for May 16, 1984 was 
a high of 80 °F and a low of 69 °F) 

• There was a potential for a static charge buildup from the falling column of liquid 

o It was reported that the tanker was grounded properly 
o The stainless steel bucket used to drain the residual amount of MMH was not 
grounded 

• There was non-compatible rust-proofing undercoating on the wheel fenders of the tanker 

• The method of the flange removal was suspect 

o One bolt was left in the flange allowing it to rotate out of the flow path freely while 
spraying MMH in a fan-like pattern increasing the surface area wetted by liquid 
MMH and introducing large amounts of MMH vapor into the air 

It is unknown whether the fire started on the tanker structure or in the bucket. The 
SCAPE technician did state that he did not feel the heat on his hands until after the residual MMH 
had been emptied from the tanker into the bucket. Draining of fuel without knowing that an 
ignition source was present was the proximate cause of the incident. Improper configuration 
management (maintenance of the hardware to prevent the buildup of rust) and an improper 
training of personnel (flange removal) are noted as the root causes of this incident. Following the 
fire, improvements were made to the fuel storage area water deluge system and the fuel tanker 
trailers. More safety showers were also added to the storage area. 

References: McCoy; Washburn 

LIQUID TRAP IN PURGE ADAPTER FLEXHOSE MMH SPILL (5/24/1985. KSC OPF1) 

On May 24, 1 985, while preparing for the removal of R4D (down-firing thruster on the 
Space Shuttle right pod) from OV-099, there was an MMH spill in OPF1 on the 10-foot level west 
side. R4D was being removed as a result of an in-flight anomaly related to a heater failure on the 
thruster. The manifold had been drained of its propellant and it was thought that a purge through 
the MD348 line (which connects to the manifold) and out the thruster nozzle purge adapter was 
sufficient to remove the liquid and most of the fuel vapors. Figure 20 shows a purge adapter in a 
cutaway of a primary thruster nozzle. During the part of the procedure where the purge adapter 
was being removed, approximately one cup of liquid MMH spilled from the thruster and down 
onto the body flap (which is illustrated relative to thruster R4D in Figure 21). The body flap was 
partially covered with spill protection sheets. The OPF1 hypergol exhaust fans were activated 
and the facility was immediately evacuated. It was recorded that some of the liquid MMH had 
saturated the body flap tile filler bar. It is unknown if the tile had to be removed. Unlike N 2 0 4 , 
which was known to breakdown Koropon primer (from the STS-2 N 2 0 4 spill mentioned 
previously), the effect of MMH on Koropon was not well known in 1985. 
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Figure 20: Space Shuttle Thruster Chamber Cutaway with Purge Adapter Installed 



Figure 21: View of Bottom of Right Pod with Orbiter in OPF 


There are three possible proximate causes to this spill. A combination of two or more of 
the following causes is also possible. The first involves an improper configuration in which the 
flexhose that was being used for the procedure had previously been utilized for a similar 
operation on the left pod thruster LI U’s manifold. This flexhose was several feet longer than the 
flexhose that was normally used for the right pod manifold evacuations. It was routed from the 
R4D thruster purge adapter to the 19-foot level above, then down to the eductor on the 10-foot 
level. This excessive length in hose may have allowed for a “u-shaped” low point trap to be 
formed in which liquid MMH could have collected. The second possible proximate cause involved 
a procedural error made by the engineers on console. The evacuation could have created a 
pressure differential across the liquid MMH. When the eductor was deactivated and removed, 
this pressure differential may have pushed the liquid into the thruster chamber. The third possible 
proximate cause was the liquid had collected in the thruster chamber (see Figure 20) and the 
purge was of insufficient duration to remove all the liquid MMH or the liquid trap may have 
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prevented the vacuum source from evaporating all the residual fuel that remained around the 
purge adapter. A definitive proximate cause was never determined. 

Eight personnel in the area of the spill received minor injuries from the inhalation of MMH 
vapors. Following the spill and cleanup, the thruster was successfully removed at KSC, sent to 
and repaired by the manufacturer (Marquardt Corp.), and then reinstalled in the same location on 
the right pod of OV-099. 

It appears that this spill could have been prevented if the proper hardware had been 
chosen for the procedure. Items of this nature should, ideally, be addressed in the written 
procedure. Part numbers, purge specifics, and toxic vapor check (TVC) sampling techniques 
should have been specified for the operation. Improper procedure control and authoring are the 
root causes of this incident. 

References: KSC SSP PRACA Database (RP01 -9-08-0031); 1985-144-00001; Heinrich 
STS-61C QV-102 SRB HPU LOADING N,H, SPILL (12/8/1985. KSC PAD 39A MLP SURFACE) 

On December 8, 1985, approximately three gallons of N 2 H 4 spilled from a Leer-Romec 
AHC on the SRB HPU system. It was later found that the AHC nipple was unthreaded from the 
AHC body because the nipple-to-cap threads had seized. Therefore, the technician in SCAPE 
was spinning off the GHC/AHC assembly from the propellant line that was online to the HPU 
propellant tank and bulk propellant rather that unthreading the GHC from the AHC (proximate 
cause). There was not a fire and the orbiter (Columbia) was undamaged. The SRB was also 
undamaged. Most of the liquid fell into the flame trench about 75 feet below. The N 2 H 4 that 
collected on the MLP surface was wetted with a fine spray of water shortly after the spill. The 
high temperature for December 8, 1985 was 72 °F. If the temperature had been much greater 
and/or any rust was present on the hot mobile launch platform (MLP) surface, ignition of the 
hydrazine would have been more probable. At the time of the spill, Challenger was on Pad 39B 
awaiting the launch for STS-51 L. The first flight of the Space Shuttle with the AHC anti-rotation 
devices installed on the SRBs was the STS-26R return to flight mission after the Challenger 
disaster. Improper vehicle design is the root cause of this incident. 

Reference: KSC Hazard Report (SPC-K1 31 67-86 Rev. B) 

INADVERTENT DRY WELL REMOVAL MMH SPILL (1/21/1986. KSC PAD 39A FUEL FARM) 

On January 21, 1986, a technician removed a temperature transducer dry well assembly 
from the three-inch MMH return line at the Pad 39A fuel farm. This was followed by a 12-foot 
high geyser of MMH from the open three-inch line. MMH contacted the left side of the 
technician’s face and his left forearm. He went immediately to the safety shower then onto a local 
hospital once he was evacuated. He was diagnosed with 1 st degree chemical burns on his face 
and 2 nd degree chemical burns on his forearm. It was estimated that approximately 100 gallons 
of MMH liquid and/or vapor was released. The seven technicians located at the fuel farm (some 
completing other unrelated tasks) immediately evacuated the area. Moments later, two 
technicians reentered the area from an upwind direction to activate the firex deluge system. It is 
very likely that this prevented a large fire. The technicians did not know that the deluge system 
could be remotely activated from the LCC by contacting them over the Operational 
Intercommunication System (OIS) or by calling 91 1 . A fire would have likely occurred 
immediately if the temperature had been a normal Florida summer day; however, it was mid- 
winter and the outside temperature was 63 °F. 

This incident took place during an annual calibration of temperature transducers and 
other components, using an OMI. The technician was correctly informed by the engineer on 
console to remove a specific temperature transducer from the MMH return line. The technician 
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mistakenly removed the dry well and temperature transducer assembly (shown in Figure 22) 
rather than the temperature transducer alone (proximate cause). If the temperature transducer 
was removed properly, there would not have been a spill. The following is a quote from the 
mishap report that explains the incident: 

“The LSOC hypergolic mechanical technician actually performing the task of 
transducer removal used incorrect shop practice and loosened the wrong nut. Instead of 
using a one-inch wrench to retain the dry well in place while loosening the transducer 
lock nut that threads into the dry well, he used the wrench to loosen the dry well. He then 
used his hand to unscrew the transducer thinking he was extracting the transducer from 
the dry well while he was actually unscrewing the transducer dry well assembly from the 
three-inch MMH line. A mixture of fluid and vapor MMH immediately erupted from the 
line sending a column 10 to 12 feet in the air.” 



Probe Sensor 



Later the engineer on console told technicians to empty the drainage sump at the fuel 
farm. This ultimately led to contamination of a large area of standing water around the fuel farm. 

It can be stated that this incident should have never happened because the GSE should 
have been vented and drained of all the residual MMH; however, the inherent design of the dry 
well assembly was to prevent breaking into a hazardous system thus allowing for a reduced level 
of PPE and risk of an incident. Granted, the design of the dry well could have been improved by 
adding a retainer to prevent the entire transducer and dry well assembly from being removed 
together (a root cause). The primary root cause of this incident was lack of training of 
technicians. Engineers have to depend upon technicians to make the correct decisions at some 
point; otherwise the controls to prevent an incident (in attempt to reduce the risk to nearly zero) 
become so cumbersome that they hinder the actual operation, let alone the additional cost of 
such controls. This is a good example of a case in which engineers had to make a judgment call 
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as to the level of PPE and system configuration. With the dry well design in mind, the judgment 
call appears to have been valid. 

There were many lessons learned from this incident. These include: 

• Dry well retainers are needed and are now used on all hypergolic propellant dry wells 

o This design flaw in the GSE is considered a root cause 

• Training of technicians for proper removal of components needs to be scrutinized 

o This is considered the root cause 

• The system tubing was not properly vented to ambient prior to the spill resulting in a 6 
psia driving pressure behind the liquid MMH (a proximate cause) 

o Hypergol systems are usually left with a blanket pressure to prevent air intrusion 
and should not be required to be vented for this type of transducer replacement 

• The system tubing had not been completely drained prior to running the transducer 
replacement operation (a proximate cause) 

o Draining of residual propellant should not be required for a transducer 
replacement as a result of the dry well 

• The procedure was considered non-hazardous; therefore, the PPE was not at a level in 
which one would don for entry into a hazardous system 

o It was believed that the hazardous system would not be compromised by 
removal of the transducer 

• Proper testing of the spill area for contamination should be completed prior to emptying 
the sump tanks to grade 

References: Cotton; Sargent; 1986-021-00001; Heinrich 

RELIEF VALVE R&R OXIDIZER FARM N,Q, VAPOR RELEASE (7/29/1986. KSC PAD 39A1 

On July 29, 1986, there was a large N 2 0 4 (N0 2 ) vapor release from the storage tank at 
the Pad 39A oxidizer farm. The event was somewhat planned; however, it was not anticipated 
that the final quantity of the release was going to be as much as what occurred. Prior to 1 986, 
when the storage tank relief valve was required to be removed and replaced annually, it was 
accepted that there was going to be a release of approximately one gallon of N 2 0 4 (N0 2 ) vapor 
as a result of the removed relief valve tubing being online to the storage tank ullage and open to 
atmosphere. The estimated vapor release following the removal of the relief valve in this instance 
was approximately 28 gallons. 

Prior to the relief valve removal, the oxidizer storage tank was vented down. Removal 
operations began immediately following the venting; therefore, the propellant in the storage tank 
was not given the proper time to cool to below vapor pressure. There was still approximately 5 
psig of pressure in the storage tank (which was visible from the remote console in the LCC) at the 
time of the valve removal (a proximate cause). 

Another proximate cause of the larger-than-expected release was the tearing of a 
SCAPE technician’s suit. He was trying to install the new valve while the storage tank was 
violently venting oxidizer vapors (as a result of the large backpressure that remained in the 
storage tank), when his suit brushed against a nearby sharp object. He proceeded to leave the 
area when he noticed the tear in his suit. This delayed the installation of the new relief valve until 
a new group of SCAPE technicians arrived at the oxidizer farm. It was reported that the cloud 
“exceeded the pre-designated clear area of 700 feet downwind” exposing several personnel to 
the toxic vapors. The venting oxidizer vapor eventually cooled the liquid in the storage tank from 
the boil-off. This significantly decreased the violence of the heavy vapor venting. 

Along with the first technician who tore his SCAPE suit, two other technicians were 
exposed to oxidizer vapors. One noticed yellow stains on his undergarments following the 
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removal of his SCAPE suit. The other reported burns on his right hand later in the day. All the 
exposed technicians were sent to the KSC Occupational Health Facility (OHF) and released back 
to work within a few hours. 


An improper GSE design and operational human error were the root causes of this 
incident. About ten months prior to this relief valve removal and replacement operation, a formal 
request had been submitted by engineering to install a dual relief valve system onto the storage 
tank with a three-way isolation valve to prevent a vapor release during component removal. This 
request was denied. Following the large vapor release, the modification was implemented at both 
launch pads, greatly reducing the possibility of any future hazard. This dual relief valve 
modification allowed for isolation during the relief valve annual maintenance. The modification 
was also implemented on the fuel storage tanks at both launch pads. Figure 23 is a photograph 
of the relief valve locations on the top of the N 2 0 4 storage tank with a close-up photograph of the 
relief valve three-way isolation valve modification. 



Figure 23: Dual Relief Valve Modification Location 


References: KSC Hazard Report (SPC-K1 21 86-85); 1986-210-00001; Heinrich 
OPF2 TRENCH N,H„ SPILL AND FIRE (9/19/1986. KSC OPF2) 

During an APU hydrazine (N 2 H 4 ) tank drain on September 19, 1986, there was a spill and 
fire in the OPF2 water deluge trench. The fire was caused by a small amount of hydrazine (about 
!4 gallon) leaking from a fitting in the GSE vent system into the deluge trench and reacting with 
debris or residual chemicals (proximate cause). The fire was isolated to the trench. The SCAPE 
technicians extinguished the flames using a nearby fire hose. 

Improper configuration management was the root cause of this incident. After the fire, it 
was found that an o-ring was missing from the outlet adapter fitting at a check valve in the vent 
system allowing an external leak. It is assumed that the vent system was free of residual 
propellants since it was purged at 35 psig; however, since the vent had been utilized during the 
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drain, some residual fuel remained in the lines. The following is a list of observations related to 
this incident: 

• Cleanliness levels in the areas surrounding hypergolic operations must not be ignored 

o The OPF water deluge trench was not routinely cleaned or inspected 

• The toxic vent system was not leak checked routinely; however, vent systems are not 
usually leak checked because they cannot be completely pressurized 

• Care needs to be taken when installing components in hypergolic ground support 
equipment 

Reference; Johnson 

NoOd AND INSULATION ADHESIVE SMALL FIRE (6/23/1988. KSC PAD 39B OXIDIZER FARM) 

On May 25, 1988, at the Pad 39B oxidizer farm, technicians were completing an N 2 0 4 
sampling operation. During the operation, the technicians detected a small leak at the interface 
between the sampling valve and the tubing (see Figure 24). The sampling operation was delayed 
until the leak could be fixed. The repair was finally scheduled to be worked about a month later 
during the afternoon of June 23, 1988. The removal of some local insulation was required to fix 
the leak along with re-torquing the fitting that connected the sample valve to the tubing. This was 
all completed that afternoon. 



Figure 24: Photograph of Sample Port 


At about 10:30 PM on June 23, 1988, the sampling operation was successfully repeated. 
This was followed by the disconnection of the sampling flexhose from the sample port. When the 
flexhose was removed, liquid N 2 0 4 spilled (about two tablespoons) into the small well surrounding 
the sample port. It was not uncommon to have a small amount of residual N 2 0 4 remaining in the 
sample flexhose when it was disconnected. The spilled N 2 0 4 reacted with the adhesive used for 
the attachment of the insulation to the tubing and ignited (proximate cause of the fire). The fire 
burned itself out in about 10 to 15 seconds before the technicians in SCAPE could return with a 
fire hose. There were no injuries to the personnel working the operation and the only hardware 
damage was to the insulation, which was replaced. 
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The insulation had been installed within hours of the sampling procedure; therefore, it 
was not given the appropriate time to fully cure. The adhesive used to attach the insulation to the 
tubing was found to contain volatile hydrocarbons. This allowed for a chemical reaction to take 
place between the adhesive and N 2 0 4 , causing ignition. The root cause of this incident was 
operational human error as a result of not allowing the insulation adhesive to fully cure. 

Reference: KSC SSP PRACA Database (PR PADB-0209) 

STS-26R QV-103 N,Q„ TUBING LEAK ON VEHICLE (7/14/1988. KSC PAD 39B) 

On July 14, 1988, about three days after the loading of N 2 0 4 onto Discovery at Pad 39B 
for the STS-26R Return to Flight mission, a small N 2 0 4 (N0 2 ) vapor leak was detected in the left 
OMS pod (LP04) of Discovery. STS-26R was the first flight following the Challenger disaster on 
January 28, 1986. The leak did not result in any injuries or hardware damage, but it did impact 
the launch date of Discovery. Along with several other Return to Flight actions, the launch team 
at KSC was required to test fire the three main engines on Discovery while it was at the launch 
pad. This was known as the Flight Readiness Firing (FRF) and was scheduled to occur on July 
26, 1988. The Space Shuttle Program decided to complete the FRF regardless of the known 
oxidizer vapor leak; therefore, the engineering team assigned to assess the leak had a couple 
weeks to study possible solutions, while other groups were preparing for the FRF. 

First, the exact location of the leak within the pod had to be found (a cutaway view of the 
Space Shuttle OMS pod can be seen in Figure 25). This was difficult because the internals of the 
aft pods and forward module are not meant to be accessed while the vehicle is at the launch pad. 
The location of the leak had been isolated to the LRCS N 2 0 4 system or the associated tubing 
through monitoring of the instrumentation in the LCC. The leak was measured to be 0.26 psi per 
hour (about 800 standard cubic centimeters per hour) and a TVC found the concentration of N0 2 
vapor to be 15 ppm at the vehicle vent door. This later decreased to 3 ppm. An access door was 
removed on the pod’s outer skin and several internal thermal blankets were removed. A long 
section of PVC pipe was then inserted into the pod to function as a guide for a borescope. Using 
a borescope, the leak was finally isolated (after a six hour search) to a !4-inch dynatube fitting on 
the MD224 leg (the N 2 0 4 propellant tank ullage vent). A cross-section view of a dynatube is 
shown in Figure 26 and a photograph of the leak location can be seen in Figure 27. 
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Figure 25: Cutaway View of Space Shuttle Orbiter Aft 


The engineering team came up with the following solutions to resolve the leaking 
dynatube: 

• Fix the leak at the launch pad (this had never been attempted before due to access 
issues) 

o Cut a hole in the aft bulkhead structure (1 307 bulkhead) and top of OMS/RCS 
pod 

■ Put a “clamshell” around the fitting and inject a sealing compound into it, 
or 

■ Drain the N 2 0 4 propellant tank, disconnect and polish the dynatube, or 

■ Cut out and replace the dynatube fitting with a new one 

o Send a “stopper” up the line from the QD to plug the line (35 to 40 feet of tubing) 

• Return the vehicle to the VAB, de-stack, and swap LP04 with LP01 from Atlantis in the 
OPF 

o The orbiter aft pods are not able to be removed and replaced at the launch pad 
since the removal and handling equipment does not exist for this type of 
operation and the pods are obstructed by the MLP tail service mass (TSM), 
shown in Figure 28 

• Return the vehicle to the VAB, de-stack, remove LP04 from Discovery in the OPF, send 
the pod to the HMF to be repaired, and re-install it onto Discovery once the repairs had 
been completed 

o This would delay the launch about two months 

• Fly with the leak and fix it following landing 
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Figure 26: Cross-Section of Dynatube Sealing Surface 
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Figure 28: Location of Left Pod on Space Shuttle 


After a week of deliberation, the “clamshell” was selected as it was the least invasive 
method to stop the leak prior to launch and it could be completed at the launch pad. Furmanite 
FSC- 6 B was used as the sealing compound as a result of it having the best compatibility 
characteristics with N 2 0 4 . The FRF was finally completed on August 10, 1988 following a few 
hardware-related delays. The repair of the oxidizer vapor leak began on August 1 7, 1988 with 
the cutting of two holes in the aft 1307 bulkhead (the bottom of the payload bay with the orbiter in 
the vertical orientation) and the top of the pod beneath the bulkhead. The dynatube’s safety wire 
was removed and a “clamshell” (shown in Figure 29) was placed over the leak. The Furmanite 
sealing compound was then injected. The leak was eliminated; therefore, the Space Shuttle 
Program cleared Discovery for launch, which successfully occurred on September 29, 1988, a 
few weeks later than the original launch date of September 6, 1988. The delay was a result of 
multiple items including the FRF test delays, return to flight SRB testing delays in Utah, and the 
N 2 O 4 leak on LP04. 
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Figure 29: Technicians Repairing STS-26R Leak at the 1307 Bulkhead 


The proximate cause of the leak was found to be a scratched dynatube. This was 
discovered during ground processing two missions later when the pod was removed in the OPF 
and sent to the HMF for repair. It was determined that the scratch must have occurred either 
when the dynatube was disconnected in October of 1987 to allow access to a nearby valve for a 
removal and replacement or when it was reconnected in late December of 1987. Following the 
reconnection, the dynatube fitting passed all leak checks. Transport vibrations may have 
“altered” the state of the connection between the HMF, OPF, and launch pad; however, this is 
highly unlikely since dynatubes do not typically change mechanical state, especially with safety 
wire installed. The Kersey report states that “The most probable cause was that the mass 
spectrometer probe operator probed the wrong RCS propellant system (i.e. MMH instead of 
N 2 0 4 ).” Operational human error was the root cause of this incident along with improper training. 
This categorization was given as a result of the incident being a consequence of either an 
inadequate inspection of the dynatube sealing surface or an error made during the leak check of 
the dynatube. 

A question was raised concerning the accuracy of the mass specification leak check, 
which was the leak detection method used on this dynatube in December of 1987. As a result, a 
new policy was implemented to independently verify zero leakage using two separate methods. 
Currently, the Space Shuttle hypergol systems utilize a hazardous vapor (“sniff’) leak check, in 
addition to the mass specification leak check of individual fittings when they are disconnected for 
any reason. 

The Kersey report also lists the following as findings and recommendations to reduce the 
risk of an undetected dynatube leaks in the future (below some items are resolutions to the 
findings or recommendations): 

• Findings and Recommendations: 

o The system decay check may not have detected this leak, 
o Increased discipline is required at the HMF in the use of OMI’s, Job Cards, and 
the PRACA [Problem Reporting and Corrective Action] system. 

■ A new OMI was developed along with a Quality Awareness Bulletin to 
ensure problems are properly documented, 
o Training was less than adequate. 
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■ A new Dynatube Connection and Inspection course was created and 
added to the technician’s certification plan along with updating the 
existing courses. 

o The existing mass spectrometer units are complex to operate, outdated, and 
vulnerable to transportation damage. 

■ Six new Leybold mass spectrometer units were procured. 

o Perform mass spectrometer leak tests of all joints in lieu of rough pressure decay 
checks, when systems have been decontaminated/cleared of hypergolic 
propellants. 

o Revise procedures to include data sheets, requirements, calculations, and 
equipment verifications to assure accurate and consistent data is recorded for 
mass spectrometer leak checks. 

■ Procedures were revised. 

o Procure new tools, develop repair standard and inspection procedures to the 
latest criteria, and develop a standard training certification program for all 
personnel working with dynatube fittings. 

■ Two new repair kits were procured. 

■ Standard OMI’s were developed for dynatube inspection and repair. 

■ The inspection specification was updated with specific criteria. 

■ A formal certification was established for working with dynatube fittings. 

o Form a well-trained and dedicated mass spectrometer maintenance team 

authorized to do repair work. 

■ An engineering “focal point” was established for controlling all efforts with 
dynatube fittings. 

References: Delventhal; Banke; Glisch; Fisher; Kolcum; Draus; Kersey 
WSTF FUEL WASTE FLASH FIRE (2/16/1990, WSTFt 

Following a fuel (it is unclear if it was N 2 H 4 or MMH) operation at WSTF, a portable fuel 
aspirator was being drained into a 6,000 gallon fuel treatment tank. The aspirator tank contained 
approximately 40 gallons of liquid (5% fuel and 95% water). At the time the treatment tank 
contained approximately 600 gallons of water, 25 lbs of calcium hypochlorite, and 10 lbs of 
caustic. The aspirator was gravity drained into the treatment tank and then flushed with 
approximately 200 gallons of water. Approximately 25 lbs of HTH chlorine was then added to the 
top of the treatment tank causing an immediate reaction and a flame approximately 1 5 feet into 
the air above the tanker hatch (proximate cause). The fire went out after a second or two. There 
were no reported injuries or hardware damage as a result of the fire. Safety personnel 
recommended that the water content of the treatment tank be doubled and a sample of the fuel 
content be taken. It was found that the fuel content was 1 .3% after the water had been added 
(recall that a 65% water to 35% fuel mixture is sufficient to prevent a fire). The fire was likely a 
result of fuel vapors present in the tank ullage volume. Operational human error is the root cause 
of this incident as a result of the technician creating a fuel vapor rich environment during the 
emptying of the aspirator tank; although, preventing this would have been difficult. 

One possible cause of the fire is the NaOH(aq) + HCI -» NaCI + H 2 0 reaction, which is 
highly exothermic. It is possible that residual MMH or N 2 H 4 dissociated from solution while 
flowing into the containment tank and collected in the ullage to later ignite from the heat 
generated by the addition of the HTH into solution. This, however, has not been proven. 

Reference: Henderson 

ASPIRATION OF N,0, INTO FUEL VENT SYSTEM (3/26/1990. WSTF TS 401) 
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On March 26, 1990 at Test Stand (TS) 401, a fuel (MMH) aspiration flexhose was 
mistakenly connected to the N 2 0 4 manifold service valve, SV12, instead of the fuel manifold 
service valve, SV1 1 . There were incorrect identifications etched on the metal plate above each 
valve (proximate cause). The valves themselves had the correct color-coded plastic tags 
attached; however, following the test firing of a nearby engine, the tags had melted and fallen off 
as a result of the excessive heat. 

When the service valve SV1 2 (incorrectly labeled as SV1 1 ) was opened, hypergolic 
reactions began to take place in the fuel aspirator flexhose and downstream vent lines. The 
oxidizer manifold pressures dropped from 80 psia to 22 psia and the technicians noted that the 
flexhose was warm to the touch. The service valve SV1 2 (really SV1 1 ) was immediately closed. 
Later, the flexhose was removed and flushed with water along with the fuel aspirator. It was 
approximated that a maximum of 2 tbsp of N 2 0 4 may have been aspirated. The technicians 
noted some discoloration in the flow direction identification tape on the fuel aspiration lines. It is 
thought that most of the reaction took place in the flexhose and first 25 feet of the TS 401 facility 
line. 


Improper configuration management (improper labeling of components) was the root 
cause of this incident. Some possible improvements to the test setup include keying in the N 2 0 4 
and MMH fittings to preclude mismatching and improved labeling and redundant labeling of 
components. 

Reference: Meyer 

HMF SCREENS TEST DRUM MMH SPILL (12/7/1990. KSC HMF M7-961 EAST TEST CELL) 

During the first aft reaction control system (ARCS) propellant tank screens test at KSC’s 
HMF M7-961 East Test Cell on December 7, 1990, roughly one to two gallons of liquid MMH 
spilled from the relief valve of a 55 gallon MMH drum and onto the floor of the test cell. The 
amount of liquid MMH, sufficient to cover the lid of the 55-gallon drum, represented a significant 
surface area once it spilled to the HMF cell floor. Experience and research have shown that the 
likelihood of an MMH flash fire is directly proportional to its surface area. It was fortunate that this 
incident did not result in a fire, which likely did not occur as a result of the conditioned air in the 
test cell being about 70 °F and the floor area being clear of any iron oxide. Once the source of 
the leak was determined, the manual fill valve was closed, the drum was pressurized, and the 
liquid was drained back into a nearby tanker trailer. 

It was determined that a hard-line hose from a technician’s SCAPE suit caught on a 
manual fill valve handle and opened it, filling the drum from the tanker (proximate cause). The 
handle was sticking out beyond the edge of the panel. Following the spill, the handle was 
removed and rotated 180 degrees so that it no longer protruded beyond the edge of the panel. 
Entry into the cell was not allowed for several days since some of the liquid MMH ran into areas 
that were not easily accessible. The root causes of this incident were improper GSE design 
(protruding handle) and human error (lack of technician situational awareness). One must 
consider, however, that a technician’s visibility in a SCAPE suit is poor, especially peripheral 
vision. 

References: KSC SSP PRACA Database (PR C72-1 631 -03-001 -001 5 and PR HMFE-0299) 
STS-42 QV-103 FERRY PLUG REMOVAL MMH SPILL (2/12/1992, KSC OPF31 

Following the STS-42 mission and ferry flight of Discovery from EAFB on February 12, 
1992, approximately 'A to 3 A cup of MMH spilled from a RCS thruster nozzle. This occurred when 
the ferry plug was removed in OPF3 (proximate cause). The liquid contacted the gloves and right 
shoe of the technician who was removing the plug. There was no reported hardware damage. 
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The collection of liquid in the thruster was believed to be a result of cold temperatures causing the 
thruster valve to leak (see section 0). The vehicle was not powered during at least one stopover 
for refueling of the SCA; therefore, the thruster heaters remained off. At this point in the Space 
Shuttle Program, the limitations and sensitivities of the thruster valves were well understood. The 
root cause of this incident was improper design as a result of not implementing provisions to 
provide ground power during the SCA stopover. 

Reference: RCS Thruster Heater Power during Ferry Flight Stopovers; Heinrich 
WSTF INCORRECT FLIGHT CAP N,0 4 EXPOSURE (11/4/1992. WSTF1 

While installing flight caps on the OMS ground test article at WSTF on November 4, 

1992, a technician attempted to install a %-inch AHC cap to a %-inch AHC. The technician was 
subsequently exposed to liquid N 2 0 4 and suffered minor chemical burns on his hands and 
forearm. Both the %-inch cap and %-inch cap have a protrusion that acts as a secondary seal 
when installed on the AHC. The %-inch AHC cap protrusion is 0.235-inch longer than the %-inch 
AHC cap protrusion (see Figure 30). This additional length is enough to actuate (depress) a %- 
inch AHC poppet if the proper force is applied to the %-inch cap (proximate cause). The only 
action to reduce the possibility of a similar event occurring in the future (short of a redesign) was 
more extensive training and certification of the technicians; therefore, this was considered a root 
cause for this incident along with operational human error and improper vehicle design. Other 
lessons learned and findings include: 

• The appearance of a %-inch AHC cap is such that it could be mistaken for a %-inch AHC 
cap to an untrained technician 

o The technician was undergoing on the job training under the direct supervision of 
an experienced technician, but the distinction between a %-inch cap and a %- 
inch cap was not explained to him 

• Age and wear made part number identification on the AHC cap difficult 

• Work instructions should be written to include positive identification of interface 
equipment 

• AHC cap mating should not be considered a benign activity; therefore, PPE should be 
used to protect the employees from credible releases of propellants 

• Future designs should consider keying of AHC caps to preclude incorrect size/commodity 
installation 



Figure 30: %-inch and %-inch Hypergolic Flight Cap Cutaway View 


Reference: Reynaud 

THERMOCHEMICAL TEST AREA N,Oi VAPOR RELEASE (4/21/1994, JSC BUILDING 353) 
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On April 21 , 1994 at the JSC Thermochemical Test Area (TTA) Building 353, there was a 
large N 2 0 4 vapor release at approximately midday. Engineers and technicians were preparing for 
a simulated altitude test of a small bi-propellant rocket engine. Oxidizer was first flowed in the 
system on February 22, 1994; however, a few leaks were noted and the system was drained and 
refilled twice following troubleshooting of the noted leaks. During the thruster firing procedures on 
April 21, 1994, a three-way solenoid valve failed allowing liquid N 2 0 4 to leak into the vent line and 
oxidizer burner stack (proximate cause). It was later determined that the valve had an extra one- 
half of a Teflon seal, extensive corrosion, and some small scratches on the armature. It is 
unclear which particular item caused the valve to leak, but the most likely candidate was the extra 
one-half of Teflon seal. 

The test team was unaware of the valve failure and continued on with their procedures. 
They first brought up pressure in the oxidizer tank to approximately 850 psig, which was greater 
than the desired pressure of 800 psig. The solenoid valve leak rate then increased filling the 
burner stack with N 2 0 4 liquid and vapors. The over-pressurization required the test team to vent 
approximately 50 psig off of the system. When they proceeded with the venting process, a small 
amount of oxidizer vapor exited the burner stack. This was an indication that there was a 
problem with the system; however, the test team proceeded on while rationalizing the small 
oxidizer cloud as an incorrect methane burner supply valve setting. 

The test team decided to continue on with their procedures even though there was an 
inadvertent oxidizer vapor release and some data in the control room was indicating possible 
issues with the system. It is unknown if the test team simply did not notice the data or they 
misinterpreted it. A short amount of time passed while the test team assessed the situation 
allowing the oxidizer tank pressure to drop (as a result of the leaking three-way solenoid valve) to 
600 psig. The test team failed to notice the significance of the 200 psi pressure drop and 
proceeded to increase the oxidizer tank pressure again to approximately 800 psig. When they 
did this, there was a large N 2 0 4 (N0 2 ) vapor release from the burner stack (approximately 16 to 
20 gallons of liquid N 2 0 4 and N0 2 vapors). The oxidizer cloud traveled downwind in a westerly 
direction resulting in the displacement of dozens of people. About 81 people (9 NASA personnel, 
70 contractors, and 2 visitors) received minor injuries from inhalation of the oxidizer vapors. 

The following are contributing factors and/or lessons learned from this incident: 

• A formal emergency response did not exist for this type of event 

o The emergency response personnel at JSC lacked the proper training and 
practice for a hypergol spill, vapor release, or fire at the time 

• The process lacked proper identification of safety control hazards and emergency 
procedures 

• There were insufficient controls in the system as it contained single point failures 
(improper design; a root cause) 

• The system should have contained a bypass relief valve that could withstand liquid lock 
(improper design; a root cause) 

• Several attempts were made to tighten leaky fittings and clean up liquid oxidizer spills 
without the use of any PPE 

• The test team failed to notice the severity of the events as they were unfolding by either 
the data that was being obtained in the control room or the initial small cloud of N0 2 
vapor that was released; lack of situational awareness or human error was one root 
cause of this incident 

• The test team lacked the proper training for dealing with hypergols (another root cause) 

• JSC management was unaware of the risks in preparing for and conducting the test of 
this bi-propellant rocket engine 

• There was a lack of voice and video recording of this operation 

• Facility changes were not processed correctly and were not distributed to the appropriate 
disciplines; improper configuration management was another root cause of this incident 
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• KSC management also felt the need to assess their own safety practices following this 
incident 

o GSE and facility designs, training requirements, emergency response 
procedures, and procedure review practices were reviewed and updated 
accordingly for all hypergolic systems at KSC 

References: Rathgeber; Torpey 

TITAN IV A K-9 N,Oj SPILL (8/20/1994. CCAFS SLC-41 ) 

On August 20, 1994, at Space Launch Complex 41 (SLC-41) on CCAFS there was a 
large release of liquid N 2 0 4 . Oxidizer was being loaded into the Titan IV A’s solid rocket motor 
(SRM) thrust vector control (TVC) system in preparation for the launch of the National 
Reconnaissance Office’s Mercury Electronic Intelligence or ELINT satellite on August 27, 1994. 
The N 2 0 4 was used to alter the combustion in the Titan IV A SRM nozzle and, therefore, provide 
TVC. A photograph of the SLC-41 launch pad with a Titan IV A is shown in Figure 31 . A diagram 
of the Titan IV A’s TVC system is shown in Figure 32 with the numbered callouts listed in Table 2. 
The incident occurred about three and a half hours after sunrise when the solar heat caused the 
pressure to increase in the N 2 0 4 tubing while the system was in a static configuration. 



Figure 31 : SLC-41 with Titan IV A (Servicing Structure Retracted) 


The pressure increase went unnoticed by the engineers and technicians. Remote data 
monitoring was available on the launch vehicle, but not on the propellant transfer systems (GSE). 
Local dial gauges likely showed the increase in pressure; however, there were no technicians 
monitoring these particular gauges. The pressure rise eventually caused a weld seam to fail at 
the base of the transfer system (proximate cause). This portion of the N 2 0 4 servicing GSE lacked 
a relief valve, thus allowing the propellant in the tubing to become “liquid locked” since a drain- 
back and purge had not been completed (improper design; a root cause). There was no damage 
to the GSE (excluding the ruptured tubing) or vehicle hardware and there were no reported 
injuries. 
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Figure 32: Titan IV A TVC System Schematic (see Table 2 for references) 


Table 2: Component Callout Descriptions 
Component Item Item # Component Item 


Injectant Tank 

TVC Tank Extension Assembly 
GN 2 Fill and Vent Valve 
Tank Assembly Base Section 
GN 2 Valve Purge System 
Quick Disconnect Coupling Assembly 
Tank Assembly Support Tie Rod 
TVC Tank Extension Shear Fitting 
TVC Tank Assembly Fairing 
Transfer Tube Support Assembly 
Injectant T ransfer T ube 


12 TVC Heat Barrier Boot 

13 Injectant Manifold 

14 Self-Sealing Coupling Assembly 

1 5 Injectant Valve Housing 

16 Pyroseal Assembly Components 

1 7 Injectant Valve (FCV) 

18 TVC Distribution Box 

1 9 Power T ransfer Switch 

20 Power Bus Terminal Strip Assembly 

21 Electrical Distribution System 

22 TVC System Storage Battery 
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Usually this tubing would not contain any propellant unless a loading operation was 
underway; although, schedule pressure led to the decision to halt the propellant drain-back and 
purge following the loading. The processing schedule had been delayed by a couple hours as a 
result of addressing a leak on a fill and drain valve on the SRM TVC system. Once the fill and 
drain valve leak was repaired, other non-related, time-critical work required attention on the upper 
stage of the Titan IV rocket. As a result, the Launch Conductor delayed the purge of the oxidizer 
loading system by several hours since these two operations could not be conducted in parallel. 
Once the upper stage task was completed, the Launch Conductor delayed the purge again to 
allow the engineers and technicians to prepare for the fuel loading operation. Fifteen minutes 
after the vehicle fuel tanks were loaded for flight, the N 2 0 4 GSE tubing ruptured. The release 
amount was approximately 350 to 400 gallons into the launch pad transfer slip. 

Another root cause of this incident was determined to be frivolous procedure deviations. 
The loading team and Launch Conductor had experience with successfully delaying the oxidizer 
drain-back and purge; however, this experience was based on insulated oxidizer tubing. The 
tubing at SLC-41 had recently been removed and replaced with non-insulated tubing as a result 
of the moisture trapped in the insulation causing accelerated corrosion. The loading team and 
the Launch Conductor either did not recall this or they were never told. 

There are requirements for launch Pads 39A and 39B to have seamless pipe throughout 
and to have relief valves in tubing that could become "liquid locked.” Following the incident at 
SLC-41 , the procedures were changed to preclude this sort of incident from happening in the 
future. The procedure deviation approval rules were also reaffirmed to the loading team and 
Launch Conductor. 

Reference: Rodgers; Skaja 

STS-69 QV-105 LEFT POD MMH FIRE (12/9/1994. KSC OPF1) 

During the STS-69 OV-105 flow, while performing a thruster L3D removal and 
replacement, an MMH flame was reported in the Space Shuttle left OMS pod stinger area (see 
Figure 33 for the relative location of the stingers). The technician in SCAPE was preparing to 
inspect the dynatube (approximately an hour after the thruster was removed) with a mirror when 
he reported a small flame on the MMH thruster feedline dynatube. Another technician was 
unable to find any water to put out the fire and mistakenly picked up an alcohol bottle and 
sprayed the flame which produced a small flash near the feedline, igniting the residual MMH 
inside it. It is believed that the technician thought the spray bottle was Freon. It was reported 
that the flame was extinguished by the technician placing his SCAPE glove over the dynatube 
end. This was probably not the best idea since MMH can react exothermically in a rigid volume 
and burn in an atmosphere 2.5% to 98% by volume in air. 

Prior to the reported fire, the technician removed the Aclar (plastic film) bag from the 
open end of the thruster feedline dynatube fitting. This fitting connects the manifold to the 
thruster. When he did this, he noted that there was an exceptionally large amount of fuel vapor 
present and some liquid MMH was dripping from the open line. The technician proceeded to 
place the aspirator directly on the feedline dynatube (the procedure and known practice was to 
place the aspirator perpendicular to the dynatube exit). This was likely the proximate cause of 
the fire. The engineer on console then noted that the manifold pressure dropped from 16 psia 
indicated to 6 psia indicated in about five seconds (the transducer had a 2 psi offset). The 
manifold pressure stabilized to 16 psia indicated after a couple minutes. At this point, the 
technician was instructed by the engineer to remove the aspirator from the dynatube. He did this 
and then left the area to find a mirror to aid in the dynatube inspection. When he approached the 
dynatube with the mirror he noted a “cream/yellowish color” flame and “heat waves.” As 
previously mentioned, he proceeded to put out the flame with his glove after the other technician 
doused the area with alcohol. 
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Figure 33: Stinger Locations on Orbiter 


The engineer on console was not convinced that the technician had seen a flame 
because it was his belief that MMH fires are not visible or are clear (as noted in section 
“Properties of Hydrazine (N 2 H 4 ) and Monomethylhydrazine (MMH),” MMH flames are usually light 
yellow in color). He thought that the technician had seen some off-gassing of the MMH that was 
enhanced by a nearby light source; however, this cannot explain the flash fire from the alcohol 
spray. This flash required a flame to already be present. The engineer voiced his thoughts to 
management and they trusted his opinions as the system expert. The technician who reportedly 
put out the fire with his glove, later made a statement that he was instructed to “not talk about 
flames or fires over the net” by engineering and technician operations. If this did actually occur, it 
is very unfortunate that the technician was specifically told to not follow the appropriate safety 
protocol in the event of an incident. 

It was later determined through analysis that an MMH decomposition (exothermic) 
reaction had occurred in the thruster feedline and there was likely a flame present. When the 
aspirator was placed onto the dynatube, it removed the inert GN 2 from the line and replaced it 
with an inrush of air. The residual MMH that remained as a thin film around the inner diameter of 
the tube began to react with the oxygen in the air. When the decomposition reaction reached a 
temperature of 382 °F within the interior of the feedline, ignition occurred. A flame will persist 
until the fuel is exhausted or the oxidizer is removed or exhausted. In this case, the glove of the 
technician’s SCAPE suit removed the oxidizer. 

No damage to the tubing or to other hardware was found during the inspections 
immediately following the fire. The PR closure stated the following as a possible reason for 
ignition: 

“...the ignition was the result of a vacuum being inadvertently placed on the line 
by a technician using a spill aspirator. This vacuum removed the inert GN 2 which was 
present inside the line. When the aspirator was pulled away, it allowed air to enter the 
line. The air, which contains oxygen and carbon dioxide, reacted with the thin layer of 
fuel [MMH] residue inside the tube. This reaction continued until the fuel [MMH] has 
reached the flammability limit of 382 °F. ” 

Possible annealing of the feedline became a concern. This was addressed in the original 
PR in which the closure stated the following: 
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“...assuming the worst case where the tubing was annealed during the fire, the 
maximum pressure (approximately 1200 psia) the line could have possibly seen was well 
below (less than 50%) the yielded strength of 5/8-inch diameter, 0.028-inch thick 21-6-9 
cres [corrosion resistant steel] tubing in an annealed condition. ” 

This event displayed a break-down on many levels including: 

• The technicians were improperly trained (aspirator directly on dynatube) 

o Improper training was one root cause of this incident 

• Operational procedures did not adequately safe the system for hazardous operations (a 
root cause) 

• The engineer was not cognizant that an MMH fire has a light yellow flame and is very 
likely to ignite under the right conditions (decomposition reaction) 

• The technician was told not to discuss an emergency-type situation on the 
communications net 

• A charged water hose or water source was not nearby during the operation 
References: Applewhite; Weber 

STS-69 OV-105 RIGHT POD MMH FIRE (5/4/1995. KSC OPF11 

During the STS-69 OV-105 flow, while performing a thruster R1A removal and 
replacement, a fire broke out in the Space Shuttle right OMS pod stinger area. The fire burned 
strongly for about 30 seconds and a smaller flame burned for about one minute and 45 seconds. 
The size of the flame was estimated to be approximately 1 5 inches x 1 1 inches x 1 1 inches with a 
damage region of approximately 22 inches x 14 inches x 14 inches in the stinger. The materials 
that burned included several ounces of fuel, a shop light, and the Orcofilm spill protection (flame 
retardant covering films). Figure 34 is a still image from the video recording during the fire and 
Figure 35 is a clearer color photograph of the same area for reference. 

A technician in SCAPE was disconnecting the R1 A thruster MMH feedline dynatube 
during a thruster removal and replacement procedure. The procedure was initiated following an 
in-flight anomaly that occurred on the thruster during on-orbit operations (R1 A primary thruster 
failed off due to a low chamber pressure). The N 2 0 4 dynatube had already been disconnected 
and double-bagged in attempt to contain the residual vapors that were being released from the 
fitting. The technicians were told to place an aspirator near the N 2 0 4 dynatube and proceed with 
the fuel feedline disconnect operation. When the seal of the fuel dynatube was broken by the 
technician using a wrench, he noted that there were “large drops of fuel being siphoned away by 
the aspirator.” Immediately following this, a fire erupted. There were six SCAPE personnel in the 
area when the fire was first reported. The proximate cause of this incident was the disconnection 
of the dynatube without knowing that there was liquid fuel within the tubing. 

The technicians managed to put the fire out with a parts rinse bucket nearby, which they 
had to refill several times with water in the safety shower. Apparently, there was not a charged 
water line in the vicinity. Once the fire had been reduced in size from a large flame to a small 
flame at the open end of the dynatube, a technician cupped the end of the dynatube with his 
SCAPE suit glove and placed the aspirator in the flame, which immediately put out the fire. 
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Figure 35: Color Photograph of Right Pod and Orbiter Aft 
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The engineers on console in the LCC believed that they had purged the manifolds 
enough to reduce the residual MMH to manageable levels. Immediately preceding the feedline 
dynatube disconnect, the engineer on console incorrectly read the fuel feedline pressure 
transducer on the vehicle. The subject transducer indicated 16 psia (approximately atmospheric 
pressure). In actuality, the transducer was biased low (as determined from a previous test 
completed during the OMDP of RP01 about 18 months prior); therefore, the actual pressure in the 
manifold had increased to about eight psi above atmospheric pressure. There had also been a 
shift change between the venting and disconnection operations which may have led to the 
transducer bias going unnoticed. The increase in pressure may have been a result of a leaking 
manifold one isolation valve (LV317, the valve holding back the bulk propellant from the feedline). 

Another possible scenario (not included in the formal mishap report) for the pressure 
increase was put forth stating the pulse purges were unable to remove all the liquid MMH as a 
result of a low point trap present in the manifold near the MD31 7 (manifold 1 drain/purge QD) 

AHC interface. Figure 36 shows the basic layout and low point in fuel manifold 1 in the right pod 
stinger area. It is believed that during the purge, gas was unable to enter the line through the 
MD317 QD to displace the liquid MMH out of the manifold. This was a result of a small bubble 
that had formed in the low point as a result of helium coming out of the liquid MMH/helium 
solution. The helium slowly coming out of solution may have been the source of the pressure rise 
in the manifold rather than a leaking manifold isolation valve. Once the fire started, it heated the 
area thus increasing the pressure and pushing additional fuel out of the fuel feedline that was 
trapped. In both scenarios (leaking manifold isolation valve or helium coming out of solution), 
liquid MMH was present in the manifold line just prior to and during the fire and the manifold 
pressure increase went unnoticed. 



The “official” cause of the ignition from the mishap report was stated to be electrostatic 
discharge passed from the materials (Orcofilm being one of them) used for spill protection to the 
SCAPE suits, gloves, and tools. The spill protection materials and SCAPE suit failed electrostatic 
testing performed following the mishap. Another possible cause for ignition (not put forth by the 
mishap report) was a decomposition combustion reaction of the MMH and a material that it 
contacted. A hypergolic reaction with the N2O4 (N0 2 ) vapors that were possibly leaking from a 
nearby double-bagged oxidizer feedline dynatube was not a likely source of ignition since the 
aspirator was positioned directly adjacent to the open end of the oxidizer feedline. An 
atmosphere of approximately 1 0% N2O4 (N0 2 ) vapors is needed for a hypergolic reaction with 
MMH vapors in air. With the amount of atmosphere that the aspirator was drawing in and the fact 
that the feedline was not receiving a constant pressurized source of N2O4, obtaining a 10% 
atmosphere of N2O4 (N0 2 ) vapors was not possible. 

About six months to a year prior to the fires on left and right pods of OV-105, a Tiger 
Team (an independent investigation team) was investigating on-orbit thruster failures. One 
finding from the study was that evacuation of the thruster feedlines to remove residual propellant 
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prior to a thruster removal and replacement was detrimental to the health of the thruster valves. 
Therefore, the thruster removal and replacement procedures were changed to disconnect the 
thruster feedlines utilizing a pulse purge rather than an evacuation, also known as a “hot” removal 
and replacement. Dozens of thrusters were successfully removed and replaced without incident 
following this change. The inadequacy of the pulse purges in removing all of the residual fuel in 
the feedline and the unnoticed pressure increase in the manifold from either a leaking manifold 
isolation valve or helium coming out of solution (operational human errors) were the root causes 
of this incident, but other unknown factors likely played a role. 

Following the fire, the oxidizer feedline was plugged and the fuel feedline fitting was 
tightened to safe the system. There were no reported injuries. There was an appreciable amount 
of damage to flight hardware from the fire and the water that was used to extinguish it, including 
several RCS thrusters, three purge ducts, some electrical harness ties, and eight thermal control 
system (TCS) blankets. This damage required removal of the OMS pod for refurbishment at the 
HMF. A total of 33 PRACA items were taken for damage as a result of the fire. The three purge 
ducts, eight thermal blankets, and four propellant line clamps were removed and replaced with 
like items along with thrusters R1R, R1U, R3A, R3R, R3D, and R1A (which was removed in the 
OPF immediately following the fire). The only thrusters that had fire damage were R1 R, R1 U, 
and R3A, the rest were required to be removed since they were located on the same manifold as 
another thruster that was being removed. The thrusters were refurbished and returned to 
logistics as usable spares. 

The delay as a result of the repair from the fire was an impact to the processing flow of 
the pod; therefore, two pods were swapped between orbiters. OV-102’s RP05 was re-assigned 
to OV-105 and RP01 went to OV-102, after repairs. RP05 had just come out of its OMDP. 

There was not one simple reason for this incident. As with most accidents, many 
different, seemingly unrelated items created the exact environment needed to support a fuel fire. 
The following items were noted as lessons learned from this incident: 

• Operational procedures did not adequately safe the system for hazardous operations (a 
root cause) 

• System hardware design forced complicated thruster removal and replacement 
operations 

o Tiger Team results led to an increase in hazard during the thruster removal and 
replacement operation 

• Designs should be completed with operability in mind 

o The thruster feedline dynatubes in the FRCS allow for independent disconnection 
of the MMH and N 2 0 4 lines, where the ARCS feedline dynatube bellows force the 
disconnection of the MMH and N 2 0 4 lines simultaneously (the orbiter FRCS and 
aft pods were designed and built by different companies) 

• Understand and design to mitigate external/environmental impacts 

• Understand failure modes during all phases of operations 

• Two valve isolation is the desired configuration (if possible) during an operation involving 
hypergols being opened to the atmosphere 

• Training of the technicians that performed the operation was found to be inadequate 
(another root cause) 

• Fire fighting equipment should be nearby when an operation involving the opening of a 
hypergolic propellant line to atmosphere is being performed 

o Walkdowns prior to the operation failed to point out the lack of fire fighting 
equipment 

o It should be noted that SCAPE personnel are not required to stay and fight a fire; 
however, historically most stay in attempt to contain the situation 

References: Buzzard; Draus 
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ORSU OPEN MANUAL VALVE NoCL SPILL (3/1/1996. WSTF 400-AREA) 


On March 1 , 1996 at the 400-Area Oxidizer Ready Storage Unit (ORSU) at WSTF, a 
large spill (about 90 gallons) of N 2 0 4 occurred. This incident was the direct result of manual valve 
MV-40X-HB77 being slightly open allowing a 1-2 gpm flow rate of liquid N 2 0 4 into the vent 
system of the 300 gallon oxidizer catch tank (proximate cause). It is believed that a propellant 
tank venting in TS 405 caused liquid N 2 0 4 to accumulate in the vent system. The liquid was 
subsequently pushed out through the vent and into the oxidizer burner stack. This venting was 
completed following a PRCS thruster acceptance test procedure (ATP) in the test stand. It is 
standard procedure to vent the primary thruster propellant tanks from approximately 260 psia to 
approximately 50 psia following an ATP. 

There was a crew located at the ORSU to collect a sample of the N 2 0 4 in the tank since it 
was being circulated on the same day to filter out particulate. Prior to this sample being taken, 
the primary oxidizer burner was set to 100 percent by the blockhouse monitor to support venting 
of N 2 0 4 (N0 2 ) vapors from the ullage of the storage tank to ambient pressure. The TS 405 
propellant tank venting occurred shortly thereafter. The personnel in the vicinity were not 
exposed to the liquid N 2 0 4 or N0 2 vapors and were immediately evacuated to a safe area. It was 
later determined that a contributing factor was that the 400-Area vent system was not an active 
system; therefore, it did not receive the full engineering design review as did the pressurized 
(active) system (a root cause). It was also found that the 400-Area configuration was not properly 
managed (a root cause). 

Reference: ‘‘Investigation of the WSTF 400-Area Oxidizer Spill Incident” 

OPF2 GSE MMH SPILL (2/17/1997, KSC OPF2) 

In OPF2 on February 17, 1997, liquid MMH (approximately a pint) splashed onto three 
personnel while they were working on removing an overhead 1-%-inch cap from the hypergolic 
vent line (the proximate cause) causing chemical burns to the arms of all three and the neck of 
one. They were all sent to the OHF. Five other individuals were sent to the OHF as a result of 
MMH vapor inhalation. 

The technicians were performing a modification to the MMH eductor system on the 10- 
foot left platform of OPF2. The modification included the installation of permanent hardware by 
removing flexhose interfaces and installing hard-line tubing, adding a suction port, and raising the 
eductor panel from the floor and attaching it to a railing. The last time the eductor system was 
used for an operation on the orbiter was about two years prior, in which MMH was drained from 
the LRCS manifold two of Discovery for the later removal of thruster L2D. It was later determined 
that the vent line had only been “blown down” rather than educted with a vacuum; therefore, liquid 
was able to collect in the low points, which should have been designed out of the system 
(improper GSE design; a root cause). 

With the technicians in supplied air respirators and hypergol compatible aprons and 
gloves, the first part of the modification, which consisted of installing a new valve and tee 
assembly for the additional suction port, was completed without incident. No liquid MMH was 
noted as spilling even though the same 1-%-inch vent line from which the spill occurs a couple 
weeks later, was opened. A reading of 0.8 ppm was noted at one of the capped fittings on the 
tubing, but this was not out of the ordinary. The 1-%-inch vent line was then opened a second 
time to install the modified 1-%-inch line that connected the new valve to the vent line. Minor 
vapors were detected when the 1-%-inch vent line cap was removed. The technicians found that 
the modified line was too short and some other lines were installed incorrectly, so they re- 
installed the 1-%-inch vent line cap and reported the problems. 
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When they returned to fix the installation a few days later, a few droplets of MMH dripped 
onto one technician’s glove and arm when he initially loosened the cap. He quickly rinsed off his 
arm in the nearby safety shower. The safety technician then proceeded to take interscan 
readings of the fitting, which he reported were 0.0 ppm. Since the readings were found to be 0.0 
ppm, the technicians determined that the liquid was probably alcohol (used for cleaning the 
fittings), water, or condensate. They all then decided that it was safe to continue. Following this, 
the technician began to remove the overhead l-^-inch vent line cap when liquid MMH spilled out 
onto his and the other technician’s skin and the surrounding GSE. Another safety technician 
nearby notified the pad leader at the OPF operations desk to evacuate the OPF and activate the 
hypergol fans to remove the residual fuel vapors. The area warning “warbler” was activated and 
proved to be ineffective at getting all of the personnel out of OPF1 , OPF2, and the OPF annex; 
therefore, the fire alarm was activated. This deactivated the hypergol exhaust fans. Why the 
area warning “warbler” was ineffective is unknown. 

The exposed technicians proceeded to take turns rinsing off in the safety shower while 
fully clothed and in their supplied air respirators. They then began their evacuation of the facility; 
however, their supplied air hoses became entangled forcing them to remove their masks while 
still in the MMH vapor cloud. Once they had exited the facility, paramedics on site began to 
examine them inside an ambulance. One paramedic indicated that the technicians had a fuel 
odor; therefore, they were instructed to remove their clothes so they could be rinsed off by fire 
personnel. They were then given blankets and transported to the OHF in two separate 
ambulances. One technician was told by paramedics to report to the OHF using his own 
personal vehicle. When he arrived at the OHF his clothes were found to be contaminated with 
fuel. He was told to shower and then put his contaminated pants back on once they were found 
to be 0.0 ppm. About 30 minutes later, he removed the contaminated pants again as a result of a 
fuel odor, and he along with the other technicians were given coveralls. When fuel exposed 
clothing is rinsed with water, the water can conceal the residual fuel in the clothing until the water 
evaporates. This is likely why the residual fuel went unnoticed in the technician’s pants resulting 
in him being asked to put his clothes back on after showering at the OHF. Per safety guidelines, 
the clothing should have been treated as hazardous waste. 

The reason for the spill was an unknown low point in the 1-!4-inch vent line which trapped 
liquid MMH. The reconfiguring of the lines allowed the low point to move around within the line 
and go unnoticed. It appears that the technicians reacted as best they could with the tools they 
had with the exception of not removing their clothing in the safety shower. The interscan fuel 
detector used during the operation was found to have a faulty pump. The pump was 
contaminated with liquid MMH and only worked intermittently; although, the interscan did read full 
scale high during the spill along with its alarm sounding. This could be the reason for the 0.0 ppm 
reading when the technician initially opened the cap; however, the pump could have been 
contaminated during the spill. There were several lessons learned following this incident 
including: 

• The fire alarms deactivated the hypergol fans and should not be used during a hypergol 
related evacuation 

o Following the incident a by-pass switch was added to the heating, ventilation, 
and air conditioning system outside each OPF so the hypergol fans can be 
turned on when a fire alarm has been activated 
o A fire alarm should not be used to evacuate personnel following a propellant spill 
o All processing facility personnel should be familiar with evacuation alarms 

• The recommended decontamination procedure was not followed in which the person’s 
clothing is to be removed prior to entering the safety shower and the clothes are to be 
treated as hazardous waste 

o Following this incident “modesty garments” were placed in boxes near the safety 
showers throughout KSC 

o Curtains were also added to the safety showers 
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• After being involved in a serious incident, personnel should immediately seek medical 
attention and should not be asked to drive themselves to the medical facility 

• The medical personnel did not seem to be knowledgeable as to the proper treatment of a 
person who has been exposed to hypergols 

• An improper GSE design can destine a system for failure 

o Low points in GSE should be designed out (root cause) 

Reference: Stefanovic 

HMF SAMPLE VALVE MMH SPILL (3/26/1997. KSC HMF M7-1212 WEST TEST CELL) 

On March 26, 1997, in the HMF M7-1212 West Test Cell, an MMH spill occurred from a 
GSE sample valve. FRC4 had been removed from OV-104 as a result of a suspect thruster 
dynatube seal saver installation. The dynatube disconnection operation required the thruster 
manifold to be drained and educted for no less than eight hours. Following this, preparations 
were made to perform a sampling operation. Three technicians set up the 20-foot safety clear 
area. One technician remained outside the clear and was not wearing any PPE. The other two 
donned hypergol compatible aprons and gloves and wore supplied air respirators. 

One technician powered up the aspirator and then began to remove the sampling valve 
outlet cap from the MD1 37 flexhose (see Figure 37 for a close-up view of the sampling valve). A 
TVC of the area was then performed with a resulting reading of 0.0 ppm. The technician laid the 
aspirator hose on the side of the rack, which was not a suitable position to capture any liquid or 
vapor that may be released from the valve outlet as the procedure stated. 



Figure 37: MD137 Flexhose Sample Valve 


The technicians were then at the point in the procedure where the valve was to be 
opened. The procedure was written to imply that there may be some vapor released from the 
valve when it was opened. Liquid MMH was not expected, but, as it turns out, there was a liquid 
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release once the valve was opened. MMH splashed out of the sample valve and onto one 
technician’s left arm, the glove of the other technician, and the surrounding area. It is estimated 
that approximately 3 A - cup of liquid MMH spilled from the valve. The technician immediately 
closed the valve and began to evacuate the test cell along with the other technicians. He exited 
the test cell and located a safety shower, which he began to use. A medical and fire team were 
immediately dispatched to the scene and the engineers on console notified the proper authorities. 
The technician did receive chemical burns on his arm for which he was treated at the OHF. He 
was released within a few hours. 

The source of the liquid MMH was a low point in the flexhose, which retained some of the 
liquid MMH following the eductions (proximate cause). How the liquid MMH was able to enter 
and collect in the flexhose low point is more complicated. The post-incident data analysis 
showed that the manifold drain and eduction were quite typical with no out-of-the-ordinary 
anomalies. However, this was the first time (at least in the memories of the engineers working 
the procedure) that a manifold had been drained in which the MMH was not saturated with 
helium. Previously, during a separate operation, the manifold had been drained and later 
backfilled with liquid propellant that was not saturated with helium. Helium had not been 
introduced into the system since the module had not flown following that operation. 

When helium saturated MMH is vented to ambient and drained from a manifold, the 
helium that was absorbed into the fuel comes out of solution and forms bubbles which rise to the 
high point of the system. The bubbles expand and act as an expulsive force while the system 
pressure is decreasing. This helps to “push” the liquid MMH out of the manifold. When 
unsaturated MMH is drained, a capillary action takes place (this is similar to holding a finger on 
the end of a liquid-filled straw). The MMH does not drain from the manifold as easily and, over 
time, it collects at the low points as a result of in-specification leakage of the upstream manifold 
isolation valves. With the system pressure at approximately 23 psia, the trapped liquid fuel in the 
low point of the flexhose was forced out to atmosphere when the sample valve was opened. 
Operational human error was one root cause since the engineers were unaware of the effects 
that the lack of helium saturation in the manifold would cause during the drain. The following are 
findings and observations from the incident report: 

• The flexhose had a low point in it; this should be eliminated though proper flexhose 
routing 

o The manifold had an inadequate drain and eduction to remove all of the liquid 
MMH 

o Operational human error (a root cause) 

• The test team did not completely understand the ramifications of draining a system which 
contained unsaturated MMH 

• The aspirator was not positioned properly at the valve when it was opened, as the 
procedure stated 

• The procedure did not identify the potential for liquid MMH being released from the 
sample valve 

o There was no method to verify that the manifold did not contain any liquid 
Reference: Sullivan 

VAFB TITAN IV A K-18 N2Q4 SPILL (7/16/1997, VAFB SLC-4E1 

On July 16, 1997 engineers at VAFB SLC-4E were remotely pressurizing the two N 2 0 4 
propellant tanks, one each on the two Titan IV A’s SRM TVC systems. Reference Error! 
Reference source not found, for a diagram of the TVC system. The propellant tank servicing 
was completed without incident about nine days prior to the pressurization. Each tank contained 
about 8,400 lbs (702 gallons) of liquid N 2 0 4 . The rocket was being prepared for a planned mid- 
July 1997 launch on a Department of Defense mission to replace an aging reconnaissance 
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satellite. Figure 38 shows a Titan IV A configuration at its launch pad and points out the location 
of the N 2 0 4 tank. 



Figure 38: Titan IV A on Launch Pad 


About 20 minutes after initiating the propellant tank pressurization, liquid N 2 0 4 was 
observed to be streaming out of the aft skirt heat shield region on both SRMs. There were no 
reported injuries and the flight hardware had minimal collateral damage (mainly on the SRM 
nozzles). At the time of the observed N 2 0 4 release (likely initially noticed by the signature 
brownish-orange N0 2 vapors characteristic of an N 2 0 4 spill) the propellant tanks were at a 
pressure of about 830 psi. The target pressure was about 1 ,040 psi. The engineers quickly 
began to depressurize the propellant tanks, which had the immediate affect of decreasing the rate 
of propellant release. The tanks were vented from their initial pressure of about 830 psi to a final 
pressure of 38 psi, at which time the N 2 0 4 release ceased. At that time, all systems were 
secured and the operation terminated. It was decided to offload all of the propellant from the 
subject tanks, so about eight hours later, the engineers and technicians began the offloading 
procedure. This operation was completed without incident. Following the offload and evacuation 
of the TVC N 2 0 4 system and tubing, the total amount of propellant transferred was estimated. 
About 1 ,160 gallons of N 2 0 4 was re-captured as a result of the drain-back. This logically implies 
that about 244 gallons of N 2 0 4 was released to the atmosphere. 

The source of the leak was found to be the electronic compartment purge ports on two 
flow control valves (FCVs) on SRM #1 and one FCV on SRM #2. A cutaway view of the FCV is 
shown in Figure 39. These valves (along with the one remaining valve that did not leak) were 
removed and sent to the manufacturer for failure analysis. Upon disassembly of the three failed 
valves, evidence of combustion was noted at the electrical compartment’s omniseal. The 
omniseal had been extruded through the sealing surface and the retainer ring had been ejected. 
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The degradation of the omniseal resulted in liquid N 2 0 4 flowing into the FCV’s electronics 
compartment and out the purge port. There were no leaks found within the TVC propellant tank 
or the associated system plumbing. 


Seal Vent and GN 2 Purge 



Packing Retainer/Omni Seal 
Figure 39: Titan IV A TVC FCV Cutaway View 


Failure analysis determined that the proximate cause of the seal degradation was traced 
to a chemically reactive incompatibility of N 2 0 4 with the cleaning agent, Bio T-200A, used on the 
FCVs during manufacturing at that time. Freon had long been the industry standard for oxidizer 
component cleaning; however, in 1987 the international scientific community endorsed the 
Montreal Protocol Treaty which phased out the use of halogenated hydrocarbons (including 
Freon) due to their proven role in ozone depletion. In early 1994, the Titan IV program adopted a 
policy to phase-out the use of Freon for cleaning of components and simultaneously phase-in the 
use of a trade product, Bio T-200A. 

The Titan IV program had recently finished qualification testing and production of a new 
component in the Titan IV A’s SRM TVC system just prior to the buildup of the K-18 launch 
vehicle. The new component was the FCV (four places total in the system). K-18 was the first 
mission with the new FCVs. Prior to K-18, the valves were an electromechanical valve (EMV), 
which had been used on the Titan IV and Titan III program since the early 1970s. 

The component design change was driven by the difficulty in manufacturing the EMVs, as 
well as some of its internal components becoming obsolete. A cutaway view of the EMV is 
shown in Figure 40. The intent of the valve redesign was to make as few changes as possible to 
allow for consistent manufacturing, part machining, and part procurement, as well as using the 
same outer housing of the valve to allow the new FCV to essentially be “dropped in” without any 
TVC system modifications. There are several noted differences between the two valve designs. 
One significant difference is their method of fastening the packing retainer to the omniseals. Both 
designs utilize an omniseal to isolate the N 2 0 4 from the valve’s electronic compartment. 

However, the original EMV design fastened the omniseal and packing retainer using four screws, 
whereas the superseding FCV design employed a snap-ring to fasten the retainer. The four 
mechanical screws on the EMVs left a much smaller gap (if any) between the component 
surfaces, whereas the FCVs snap ring design, while sufficient for its launch duty, had a large 
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enough gap between the component surfaces that the liquid Bio T-200A cleaning solvent was 
able to accumulate on the omniseal spring. 



O-ring & 
Channel Seal 


Omniseal Retaining Ring 


Screw (1 of 4) 


Packing Retainer 
Omniseals 


Figure 40: Titan IV A TVC EMV Cutaway View 


A total of 74 EM Vs which had been cleaned with Bio T-200A successfully flew in the 
Titan IV A TVC system. The Titan IV program accepted the use of Bio T-200A as the cleaning 
agent for the new FCVs by analysis, ground test, and similarity to the cleaning agent’s use on the 
EMVs. The failure of three of the four FCVs on this one rocket, compared to the success of 74 
EMVs on successfully launched rockets, suggests that the method of qualifying the FCVs was 
flawed. 


In June of 1994, a subcontractor was commissioned by the FCV manufacturer to test the 
compatibility of liquid Bio T-200A with N 2 0 4 . Tests showed that N 2 0 4 reacted violently with Bio T- 
200A after about five hours of exposure (at ambient pressure and temperature). As a result of 
this finding, precautions were added in the EMV (and later the FCV) manufacturing process that 
included a drying out the components via a baking process since it was known that a dry film of 
Bio T-200A is compatible with N 2 0 4 . The manufacturer used a 30-minute bake at 100 °F, 
believing that these conditions were sufficient to remove all the liquid Bio T-200A. However, Bio 
T-200A has a relatively low vapor pressure and thus requires a comparatively long time for 
complete evaporation. Following the K-18 N 2 0 4 spill, an investigation identified that the FCV 
manufacturing process indeed left a wet residue of Bio T-200A under the packing retainer (shown 
in Figure 39). 

The presumed sequence of events leading to the subject component failure was as 

follows: 

1 . By the completion of the TVC N 2 0 4 propellant tank loading, the cavity adjacent to the 
packing retainer filled with liquid N 2 0 4 

2. The liquid N 2 0 4 vaporized and migrated into the packing retainer crevice 

3. During the tanks’ pressurization, the trapped N 2 0 4 vapor re-condensed into a liquid and 
reacted with the residual Bio T-200A in the packing retainer crevice (see Figure 41 ) 

o The energy of this reaction damaged the packing seal 
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o The force of the increased system pressure overcame the remaining, 

compromised integrity of the seal components and thus flowed past the seals to 
atmosphere. 



3 N 2 0 4 violently reacts with 
liquid Bio-T, forcing packing 
retainer away from housing 


2 N>0 4 is forced into interface 
during vehicle pressurization 


4 Face seal is damaged by reaction and/or is 
extruded through enlarged gap, allowing leakage 


I Bio-T wicks into packing 
retainer/housing interface during 
FCV decontamination 


Figure 41 : Titan IV A FCV Failure Description 


The root cause of this incident was process creep. This was categorized as “Improper 
GSE/Vehicle Design.” The USAF noted that the process of accepting the Bio T-200A as a 
cleaning solvent was not well documented and appears to have been poorly managed. The 
chemical compatibility tests (dry film and wet residue) were not given the proper attention by the 
manufacturer who believed that a dry film was the only possible remnant of the Bio T-200A 
solvent as a result of their baking procedure. 

Following the incident, use of Bio T-200A as a cleaning solvent on components in the 
Titan IV program was prohibited. All remaining uninstalled FCVs were disassembled, cleaned 
thoroughly with methyl ethyl ketone (MEK), cleaned thoroughly with Freon, reassembled, 
retested, and then returned to logistics. The reconnaissance satellite was launched successfully 
on October 23, 1997 on the Titan IV A following the replacement and retest of the four FCVs. 

References: Kehler; Hill; Schindzielorz; What You Should Know... 

PAD 39B SLOPE N,Q, SPILL (11/6/1997, KSC PAD 39B SLOPE) 

Following the oxidizer (N 2 0 4 ) loading of Columbia for STS-87 at approximately 9:30 PM 
on November 6, 1997, a flange gasket (seal) failed in the Pad 39B GSE “cross country” line 
cross-over valve complex (the GSE lines that connect the N 2 0 4 farm to the launch pad tower and 
vehicle). The seal failure resulted in the spilling of about 25 to 50 gallons of liquid N 2 0 4 onto Pad 
39B’s concrete base (proximate cause). The liquid N 2 0 4 ran down the slope and contacted some 
live electrical cables and a small electrical fire followed. The wind direction at the time of the spill 
was such that the oxidizer cloud drifted away from the launch pad tower and the vehicle. 

During the N 2 0 4 GSE drain down following OV-102’s oxidizer servicing, the cross-over 
valves were closed. A water hammer effect from the liquid column in the GSE lines opened a 
gap at the cross-over valve flanges (inlet and outlet). This gap enabled liquid oxidizer to leak out 
onto the launch pad slope (the concrete incline from ground level to the base of the launch 
tower). 
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The SCAPE van driver was the first to detect the spill when he smelled oxidizer in the 
area of the fuel farm (see Figure 42 for a geographic layout of Pad 39B). Safety officials at the 
launch pad perimeter noted the source of the oxidizer vapors was the Pad 39B west slope. Three 
technicians in SCAPE were directed to proceed to the general area of the vapor source from their 
location on launch pad tower 107-foot level. Upon arrival, the technicians noted that heavy N 2 0 4 
(N0 2 ) vapors were leaking from both the inlet and outlet flanges of the return cross-over valve. 
They also noted that there were still several gallons of liquid N 2 0 4 on the ground near the flanges 
and at the bottom of the slope in a grassy area. Sparks were seen shortly after the arrival of the 
technicians; therefore, two of the three evacuated. Some of the liquid N 2 0 4 that had flowed down 
the slope incline contacted the electrical conduits routed along the ground that supplied power to 
nearby lighting. The technicians were unaware that the N 2 0 4 had dissolved some of the cabling 
insulation. 



~Wind Direction 


Vehicle Location 
(Not Shown) 


Spill Location 


Oxidizer Farm 


H 

Cross Country Lines 


Fuel Farm 


Figure 42: Geographic Layout of Launch Pad 39B 


Since it was late at night, the technicians could not see the entire spill area very well. 

This was a result of the area being poorly lit during nighttime operations. Therefore, the 
technicians decided to activate some additional lighting at the cross-over valve complex. When 
power was issued to the lights there were several sparks and a small electrical fire ensued. The 
lights were quickly turned off and the small fire was put out with water. During the clean-up effort, 
one technician inhaled N 2 0 4 (N0 2 ) vapors as a result of his SCAPE suit zipper not being secured. 
He was sent to the OHF and released later that night. 
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There was a concern that the oxidizer vapor cloud had contacted and possibly damaged 
the Space Shuttle stack and GSE on Pad 39B. At the time of the spill, the wind direction was 
away from the vehicle and launch pad in approximately a southwestern direction (034 to 053 
degrees) at a speed of five to ten knots; however, detailed inspections were still completed. 
Thermal Protection System (TPS) engineering performed a vehicle inspection and litmus-pH test 
to determine if the vehicle TPS was exposed to oxidizer vapor. They verified no damage or 
contamination to vehicle TPS. All other engineering groups (vehicle and GSE) performed 
inspections and found no damage with the exception of the electrical cables on the Pad 39B 
slope. 


About two months prior to the spill, an operation was completed on the cross-over valve 
complex in which the flange gaskets had to be replaced. This operation was a result of noted 
leaks at the cross-over valve complex return valve as a result of (it was assumed) an alignment 
problem with the valve flanges. The valve mounts were removed to correct the misalignment 
issue. The mount removal was completed without authorizing the out of configuration condition 
as it was against what was required per the cross-over valve drawings. 

During the repair procedure, the flange gaskets were replaced; however, there was a 
discrepancy in the Pad 39B drawing for the flange. An engineering order had been issued in 
1978 to the Pad 39A drawings to require the installation of American National Standards Institute 
(ANSI) sized gaskets. The Pad 39B drawings were never corrected; therefore, an undersized 
gasket was installed. It was also found through a detailed analysis of the flange gasket 
installation procedures that the flanges were not leak tested with GN 2 following the 24-hour 
retorque of the flange bolts. This could have led to a change in the gasket clamping force. The 
combination of the undersized gasket and an inherent preload from an inadequate support 
structure under the valve complex (improper configuration management) were the root causes of 
this incident. The problem report closure statement for the spill stated the following: 

“The flange gaskets which leaked were of the white gar lock material and cut to 
the dimensions specified per [the Pad 39A cross-country line] drawing. An investigation 
revealed the material of the gaskets was compatible and acceptable for oxidizer use. 

The apparent problem was with the dimensions specified for 150 lb flange gaskets. The 
internal diameter was too large, reducing the sealing surface, and a slight gasket failure 
led to the leak. A walkdown of the pad B [hypergol tubing] was performed and all white 
150 lb gaskets were identified and replaced with gaskets cut using the new dimensions 
released per the [Pad 39B cross-country line] drawing. . .All subsequent [helium] leak 
checks and propellant flows showed no signs of further oxidizer leakage. ” 

Following this incident, the Pad 39B drawings were updated to require the installation of 
the proper flange seals. All the cross-over valves were removed and replaced with flanged pipe 
as they were no longer needed for hypergolic propellant loading. This reduced processing time 
on the valves and greatly reduced the risk of a leak at the valve flanges. Figure 43 is a 
photograph of the location where the cross-over valve complex was previously located at Pad 
39B and Figure 44 is a photograph of the location of the Pad 39B fuel cross-over valve complex 
with the fuel farm and Vehicle Assembly Building in the background. 
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Figure 43: Former Site of Oxidizer Cross-Over Valve Complex at Pad 39B 
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Figure 44: Former Site of Fuel Cross-Over Valve Complex at Pad 39A 


References: KSC SSP PRACA Database (PR S70-0700-06-002-0019); Henson 
STS-109 QV-102 APU HYDRAZINE SPILL (8/20/1999. KSC OPF3) 

During APU deservicing for OMDP in OPF3, approximately 4.5 tbsp of hydrazine (N 2 H 4 ) 
spilled from a GSE flexhose that was previously connected to a high point bleed Leer-Romec 
AHC. The liquid dripped onto the orbiter’s left hand wing inboard elevon trailing edge and the 11- 
foot level of OPF3. This AHC was only accessible in the orbiter aft; therefore, a flexhose had to 
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be routed to it through an access door for testing. It was believed that the spill was a result of 
residual N 2 H 4 leaking from the removed high point bleed flexhose that had been placed on the 
platform without a drip pan beneath it. There were no leaks noted during the operation prior to 
removal of the flexhose. The technician left the flexhose uncapped (the proximate cause) 
following disconnection and the hydrazine ran along the platform grating and then dripped onto 
the orbiter. Two tiles were removed and inspected along with the underlying structure. No 
damage was found on the orbiter elevon structure. 

The vapor levels were checked in all of the applicable areas and all were acceptable for 
ferry flight closeouts (OV-102 was leaving for Palmdale, California soon after the spill). The root 
causes of the hydrazine spill were an insufficient GSE design in OPF3 and lack of experience by 
the technician that left the flexhose uncapped (improper training). This spill was the driver for 
implementation of new permanent GSE in each Space Shuttle OPF. The new panels were 
installed, calibrated, and validated in each OPF. They provide versatility as well as the additional 
safety of a permanent installation. The installation of these new panels substantially reduced the 
possibility of another APU N 2 H 4 fuel spill during this procedure. 

References: Gehman (CAIB Volume I finding F4.2-7 and Volume II pg 427); 1999-232-00007 
WSTF PATHFINDER AXIAL ENGINE VALVE FAILURE (8/7/2000, WSTF TS 401 ) 


On August 7, 2000, during the oxidizer system decontamination procedure following an 
engine hotfire test that occurred on August 3, 2000, an axial engine valve and N 2 0 4 tubing failed 
(exploded) causing extensive damage to the surrounding hardware. There were no reported 
injuries. The volume of the spill was approximately one to two gallons mixed with several gallons 
of water. 

Following the completion of the hotfire test near the end of the work day, the test team 
and customer agreed to delay the subsequent propellant sampling and decontamination until the 
next day (Friday). The following day it was discovered that only one person was available for 
sampling and the rest were out on vacation. The sampling was completed late in the day, which 
did not allow enough time for the decontamination procedure to take place until the following 
Monday. 

On Monday August 7, 2000, the hardware was configured to support the decontamination 
procedure in which water was flushed though the propellant lines (both MMH and N 2 0 4 ). It is 
usually not good practice to flush an N 2 0 4 system with water as it forms nitric and nitrous acids. 
The procedure was performed using a TPS (Test Preparation Sheet used primarily for non- 
routine work) rather than a WJI (WSTF Job Instruction used primarily for repetitive, routine work). 
The test conductor (TC) proceeded to perform a vent of the oxidizer manifold even though this 
work step was not in the procedure or even necessary since the decontamination was intended to 
be completed with the manifold pressurized. A large N0 2 cloud was then noted at the test cell 
drain valve. The TC decided to not vent to MMH manifold since it would possibly mix residual 
propellants; therefore, he proceeded to cycle the engine valves. Following this, another “large 
oxidizer [N0 2 ] cloud was observed and a large combustion event occurred,” as quoted from the 
WSTF report. It is assumed that the damage from this event was unnoticeable since the TC 
continued on after briefly stopping the test. 

Regardless of the previous off-nominal events, the test team decided to proceed with the 
water decontamination. There was also supposed to be a nitrogen purge of the system, but the 
test team decided to not perform this operation. Deionized water at approximately 1 70 psig was 
introduced into the fuel lines. Shortly thereafter, the technician connected the water from the 
same source into the N 2 0 4 propellant lines. The technician then proceeded to exit the test cell 
and as he did, there was another explosion. A loud bang was heard by the technician and water 
was observed flowing out of an unknown source from the test article. The test system was then 
vented remotely. The following items had either failed or were damaged: 
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• Failure of a cast aluminum body of the axial engine valve 

• Failure and fragmentation of several 1-inch diameter 321 stainless steel hardlines 

• Damage to 12-inch long, 1-inch diameter thrust ring mounting bracket 

• Damage to the engine valve thrust ring mounting bracket 

• Damage to support structure which was impacted by a 321 stainless steel hardline 

The proximate cause for the failure was inconclusive. The most likely scenario is that 
MMH and N 2 0 4 reacted on the oxidizer side of the engine valve (a bi-propellant valve) possibly 
through a Kalrez seal failure. The engine valve has redundant seals on both the oxidizer and fuel 
sides. In between the seals there is a small cavity with a check valve that is designed to vent 
propellant seepage between the seals. The reaction either propagated a shock wave into the 
water filled system or accelerated columns of liquid in the water and vapor filled oxidizer system. 
Another possible proximate cause for the failure is the removal of the vacuum conditions before 
the completion of the decontamination process. 

Working steps out of sequence, not performing steps, and completing the 
decontamination procedure several days later than required (operational human error) along with 
performing the procedure with a TPS rather than a WJI were the root causes of this incident. 
Proper care was not taken with respect to procedure adherence and development. 

Reference: “Investigation Report of the WSTF Peacekeeper Axial Engine Valve Damage” 

WSTF PATHFINDER SMALL MMH FIRE (8/12/2000, WSTF TS 4011 

On August 12, 2000, a procedure was underway (using a TPS) to disconnect a fuel 
feedline to decontaminate the Peacekeeper Pathfinder Test Article MMH system. There were 
two technicians in the test cell. During the disconnection several MMH drips accumulated on 
some nearby hardware (proximate cause of the spill). The technician began to feel a significant 
amount of heat on the glove of his ILC suit (similar to a SCAPE suit) and yelled “fire.” A safety 
observer in street clothes located at the door of the test cell then entered and began to spray the 
two technicians with water. The second technician then grabbed the hose and began to spray 
down the area where the fire started, extinguishing it. There was minimal damage to the 
hardware and there were no injuries. The decision was made to complete disconnection of the 
feedline following the fire; however, the provided flange would not fit the feedline, so the operation 
was secured. 

The proximate cause of the fuel ignition is unknown. Earlier, during the oxidizer system 
decontamination (see Section 0), an unexplained rupture of an oxidizer feedline had occurred on 
the test article. It is thought that residual oxidizer could have caused the MMH ignition, but it is 
uncertain. Other possibilities include rust from the test stand or static electricity as proximate 
causes. The root cause of this incident was operational human error as a result of the lack of 
oversight and careful planning following the incident on the same test article a few days earlier. 

The quick reaction (albeit unsafe since he was not wearing the proper personal protective 
equipment) of the safety observer, likely minimized the hardware damage and prevented injury. 
According to WSTF Standard Instruction (WSI) PROP-0049, “The Buddy System in the 
Propulsion Department,” the third technician should have been attired in ILC. 

Reference: Gorham 


WSTF PRESSURE TRANSDUCER EXPLOSION (3/25/2003. WSTF TC 831) 
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On March 25, 2003, in Test Cell 831 at WSTF, during the life cycle testing of an N 2 0 4 
Improved Pilot Operating Valve (IPOV), there was an explosion. Following the explosion, there 
was an N 2 0 4 vapor release (approximately three quarts) into the test cell. There were no 
reported injuries since the cell was vacated prior to starting the test. It was found that a pressure 
transducer had catastrophically failed as a result of a material incompatibility within the pressure 
transducer (proximate cause). Figure 45 is a photograph of the test setup following the explosion 
with the relative location of the pressure transducer prior to the explosion. 

The IPOV was in the process of being validated following some modifications that were 
made to the valve. The operating pressure at the valve inlet was approximately 276 psia. The 
test was simply flowing liquid N 2 0 4 from one tank into another by cycling the valve. The pressure 
transducer was in the system to monitor this inlet pressure. Approximately 36,000 (of the 
planned 80,000) cycles of the valve, with a flow duration of approximately 80 ms and a maximum 
flowrate of 1.91 Ib/sec, had been completed when the explosion occurred. The proper 
emergency procedures were immediately implemented following the incident. These procedures 
included securing the test cell and deactivating the air handler for both the test cell and the 
attached building. There was no reported fire following the explosion. 

Initial inspections of the pressure transducer indicated that the transducer failed as a 
result of one of the following: over-pressurization, inadequate design, or cyclic fatigue at a highly 
stressed location. Since the pressure transducer failed, data from it at around the time of the 
failure may be suspect; therefore, the investigation included a detailed inspection of the nearby 
system tubing to determine if there was an over-pressurization event. Close inspection of the 
pressure transducer itself would indicate if the transducer failed from cyclic fatigue or was subject 
to a ductile failure from a single overload event. 



Figure 45: IPOV Test Setup 


It was found that the pressure transducer failed at welded connection between the port 
(media) housing and the sensor housing. Figure 46 is a photograph of the pressure transducer 
following the explosion. It was calculated that the approximate pressure to fail this butt weld 
connecting the two 300 series stainless steel components was approximately 12,700 psi. It was 
also found that the system tubing showed no sign of yielding due to an increased pressure; 
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therefore, the system pressure did not exceed the calculated tubing yield value of 3,400 psi. The 
pressure transducer diaphragm was found to have failed at an approximate calculated pressure 
of 4,000 psi. The pressure then built up very quickly in the small volume around the diaphragm 
and was unable to properly relieve through the 0.1 57-inch diameter port at the top of the 
transducer. This allowed the pressure in this small volume to roughly reach the 12,700 psi 
transducer burst pressure. 

The component failure (over-pressurization) was a result of a fatigue fracture (crack) of 
the pressure transducer diaphragm (0.002 inches thick). This allowed silicone oil to leak into the 
small volume surrounding the diaphragm. Approximately 0.8 mL of silicone oil was used to fill the 
volume between the diaphragm and the silicon sensor. The liquid N 2 0 4 reacted with the silicone 
oil to form nitrated phenols, including dinitrophenol and trinitrophenol (picric acid), which are 
shock-sensitive compounds. Some of the nitrated phenols remained between the diaphragm and 
the sensor, while the rest were diluted into the liquid N 2 0 4 in the test system. When the IPOV 
was subsequently cycled, it is assumed that the shock wave in the liquid detonated the shock 
sensitive compounds in between the diaphragm and the sensor. N 2 0 4 (N0 2 ) vapors were then 
released from the openings in the system. The vapor cloud filled the test cell and was carried by 
the wind through an air handler of a nearby building. 

The presence of the silicone oil was not mentioned in the pressure transducer 
specification from the manufacturer. This is the case for many pressure transducers of this 
specific design. Close scrutiny of specifications during hypergol component procurement is 
extremely important. This incident was difficult to prevent since the WSTF personnel did not 
know that there was silicone oil in the pressure transducer, but an improper GSE design 
(component procurement) is designated as the root cause. The wind corridor was also assessed 
and, as a result of this incident, it was altered to reduce the risk to the surrounding buildings from 
an oxidizer vapor release. 



Figure 46: Failed Pressure Transducer 


Reference: Anderson 
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TITAN IV N,0„ PUMP EXPLOSION (8/12/2003, CCAFS LC-40) 


On August 12, 2003, at CCAFS launch Pad LC-40 (shown in Figure 47) during the bleed- 
in operation for the B36 Stage II (Titan IV) propellant load, the oxidizer centrifugal pump exploded 
(proximate cause of the N 2 0 4 spill). The Titan IV launch vehicle was being loaded in preparation 
for the September 9, 2003 launch of the National Reconnaissance Office’s payload. Along with 
the liquid N 2 0 4 release of approximately 40 gallons, the explosion created a large amount of 
shrapnel which caused significant damage to the surrounding GSE. The pump was completely 
destroyed as shown in Figure 48. Fourteen people reported to an on site health facility. They 
were all later released without injury. The storage tank holding several thousand gallons of liquid 
N 2 0 4 remained intact with minimal damage. An extensive investigation was initiated as a result of 
the Space Shuttle Program using these same pumps at Pads 39A and 39B (eight pumps in four 
locations) along with the Titan program which used them at LC-40. 

The engineers had noticed a decrease in the oxidizer pump flow rate (34-50 gpm versus 
200 gpm) during the 1 8,600 gallon loading of the Stage I N 2 0 4 tanks. A meeting was held to 
discuss this reduction in flow rate in which the contractor and government team chose to continue 
on with the Stage II load. The consensus of the meeting was that an internal filter had become 
partially clogged at the oxidizer farm. The personnel had seen this sort of occurrence previously. 
Operational human error is considered a root cause as a result of the loading team not 
investigating the decreased flow rate issue further. 

Following the pump explosion, the loading team quickly removed power from the pump, 
closed the flow control valves at the oxidizer farm, and immediately evacuated the pad. The large 
N0 2 cloud that was created following the explosion was found to pose no danger to the local 
communities; however, a 5,000- or 12,000-foot clear (depending on the wind speed and direction) 
was put in place around the oxidizer farm. 



Figure 47: LC-40 at CCAFS 
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Figure 48: Pump and Motor After Explosion 

The incident failure analysis concluded, according to Crass, that there was a “cooling 
anomaly at the [carbon graphite journal] bearings... leading to [an explosion] in the stator can 
winding area.” It was found that the most likely contributor to this was a clogged filter in the pump 
recirculation loop that circulates liquid through the rotor cavity to cool the front and rear bearings 
as illustrated in Figure 49. Data analysis showed that the upstream and downstream temperature 
transducers indicated an increase in temperature of 8 °F across the pump. The low flow rate of 
40 gpm and high ambient temperatures (high of 86 °F for 8/12/2003) accelerated the failure of the 
pump. At these flow conditions, the pump was not able to be properly lubricated as a result of the 
high vapor pressure of liquid N 2 0 4 (these particular pumps are designed to be lubricated with the 
liquid that they are pumping). The excessive bearing wear led to damage to the stator liner can, 
allowing oxidizer to leak onto the hot copper windings. The N 2 0 4 reacted with the copper winding 
insulation and caused the coil wire to short, which was the proximate cause of the explosion. 
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Figure 49: Pump Schematic 
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Following the explosion, there were some design changes made to the pumps since an 
improper pump design was a root cause, these changes include the following: 

• Machining of the pump from a single billet of stainless steel rather than casting them 

• Serrations were added on the impellor housing and rear bearing housing for improved 
sealing capability 

• The addition of a thermowell for thermocouple monitoring rather than the old 
thermoswitch which proved to be unreliable 

This incident encouraged the Space Shuttle Program to consider alternate pump designs 
for its hypergolic propellant loading system. The centrifugal pumps at Pads 39A and 39B used 
for Space Shuttle hypergol loading were replaced with centrifugal pumps with the design changes 
listed previously; however, the changes did not completely mitigate the failure mode that caused 
the LC-40 pump to explode. This risk was accepted by the program and engineering team; 
although, it was mitigated by implementing the following controls: 

• Installing a blast cage around the pumps 

• Reducing the pump life requirements and performing maintenance checks every 60 
hours of runtime for final two launches of Titan from LC-40 

• Rigorously testing the remaining pumps 

And at launch Pads 39A and 39B: 

• All pumps were removed and replaced following the LC-40 pump explosion 

• The pumps were leak checked using a helium mass spectrometer 

• A programmable logic controller was installed to deactivate the pump when the 
temperature reached 140 °F along with the normal health monitoring that has always 
been installed on the pumps 

• Run-times and start/stop times were tabulated to establish a baseline for a preventative 
maintenance program (removal and replacement is required once every 100 hours for 
oxidizer and every 1 50 hours for fuel) 

• Vibration analysis monitoring devices are installed on the pumps each time they are used 

o The data is evaluated and released in a formal report following the load 

There have been four other similar occurrences (three oxidizer pumps in 1963, 1964, and 
1980 along with one fuel pump in 1962) throughout the history of the Titan program. The three 
failures in the 1960s were a result of incompatible bearing material, which was resolved, and the 
failure in 1980 was a result of a pin-hole leak in the stator liner can, which was mitigated by 
implementing a helium mass specification leak check. 

References: Crass; Comfort; 2003-224-00006 

HMF RP01 N,Q a SPILL (6/5/2004. KSC HMF M7-961 EAST TEST CELL) 

On June 5, 2004, at the HMF M7-961 East Test Cell, a technician was exposed to a few 
drops of liquid N 2 0 4 . The drops ran down the technician’s glove and onto his left arm while 
attempting to reinstall a flight cap onto MD306 (RRCS oxidizer tank entry sump bleed) on RP01 . 
The technician rinsed off his arm for about 20 minutes in a safety shower and was then sent to a 
local hospital. He was released later that day. There was not any reported hardware damage. 
The procedure included pre-operations for later testing of the RRCS helium system isolation 
valves, regulators, check valves, relief valves, and burst disks. 

The flight cap removal procedure began with the technician completing the bleed 
between the flight cap and the AHC (0.0697 in 3 for a %-inch AHC and flight cap assembly), as the 
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procedure stated. This process had the technician install a Tygon tube to the bleed port on the 
flight cap and run the tube into a nearby bucket of water. The two reasons behind the flight 
cap/AHC interstitial volume bleed are to vent off the small volume from any N 2 0 4 (N0 2 ) vapors 
that collect as a result of in-specification leakage of the poppet and to verify that the AHC poppet 
is not stuck in the open position. The two technicians working the operation were attired in the 
required PPE (hypergol compatible gloves, apron, chemical goggles, and face shield since the 
work was overhead). Supplied air respirators were on stand-by in case they were needed for any 
reason. 


When the bleed port was opened, the technician noted that he saw roughly the expected 
amount of oxidizer bubbles in the bucket of water. The two technicians monitored the bucket for 
about a minute at which time they reported that the bubbles had stopped. 

The technician then proceeded to remove the flight cap from the AHC (the proximate 
cause of the spill) at which time he noted that there was a slow liquid leak originating at the AHC 
poppet. The two technicians immediately upgraded their PPE to supplied air respirators and 
began to contain the leak with an active aspirator hose. The removed flight cap was not able to 
be reinstalled as a result of its degraded condition. The technicians requested a new cap be 
installed, which was subsequently brought into the test cell by the lead technician in street 
clothes. An attempt was then made to install the new cap without using the installation tool since 
this would require the technician to be located beneath the leaking AHC. It is claimed in the 
incident report that when this was attempted, the leak rate increased, as a result of a hydraulic 
lock from the presence of liquid between the AHC poppet and the flight cap, which had a closed 
bleed port. This does not seem to be realistic. The benefits of using the tool (the technician 
could install the cap much quicker and at an increased distance from the cap, reducing the 
likelihood of injury) are likely to out-weigh the risk, as long as the task was completed carefully. 

On a later attempt to install the flight cap, liquid N 2 0 4 ran down the glove of one of the 
technicians and onto his arm. It is believed that his skin was exposed to about two or three drops 
of oxidizer. He immediately located an eyewash station to run water over his arm for several 
minutes. Meanwhile, the other two technicians (one in PPE and one in street clothes) configured 
the aspirator hose using an adhesive tape to contain any liquid that was released from the AHC. 
The three technicians then left the test cell and the exposed technician was sent to the hospital 
from which he was released back to work about 90 minutes later. 

SCAPE personnel arrived at the scene about four hours after the initial spill. They 
commenced with a procedure to connect a GHC to AHC MD306. Once the GHC was connected 
and the test cell was verified to have a 0.0 ppm breathing zone, the cell was opened for controlled 
work. 


The RRCS oxidizer tank was later drained for the AHC poppet replacement procedure. 
This operation was successfully completed. Following the spill, it was determined that roughly 
1 .4 gallons of N 2 0 4 leaked through the MD306 poppet. The majority of this was contained using 
the aspirator. 

The incident report claims that the exposure may have been prevented if the procedure 
had been written more clearly and the technicians had been more knowledgeable of the 
chemistry that occurs when an N 2 0 4 system is vented (both possible root causes of the spill). 

The procedure directed the technician to vent (bleed) the volume between the AHC poppet and 
the flight cap for 15 seconds. The incident report goes on to say that the procedure did not 
specifically state that the volume should be vented for “no more than” 15 seconds; therefore, the 
technicians allowed the oxidizer in the interstitial volume to condense back into a liquid as a result 
of the dropping pressure and temperature during the vent. This theory is anecdotal and cannot 
be supported with any experimental or operational data. It was calculated that the leak rate of the 
N 2 0 4 from the AHC was approximately 22.7 cc/min of liquid. This amount of liquid would have 
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been clearly evident in the bucket of water by a trained technician even though it was later noted 
that the piece of Tygon tubing that was used for the operation was old (opaque). 

The course of action taken following the initial spill (containing the spill as best as 
possible and then standing down until a SCAPE technician could continue the work) was likely 
the best possible solution at the time. The effort made by the technicians to reinstall the flight 
cap, thus containing the leaking AHC poppet, were noble; however, they put themselves at risk 
by installing the cap without the proper tool and completing the task without the appropriate PPE. 

The most probable cause indicated in the incident report was likely not the reason for the 
technicians not seeing any liquid N 2 0 4 exiting the Tygon tube. There is not a sufficient amount of 
data supporting or disputing the most probable cause presented in the report. Another possible 
scenario brought forth by NASA systems engineering was that the flight cap bleed port was 
blocked (partially or fully) by nitrate crystals that form when N 2 0 4 (or N0 2 ) within an iron or iron 
alloy containment vessel is given the chance to mix with humid air and then later dry up. Proper 
training of the engineers and technicians was a possible root cause of this incident; however, it 
remains unclear what the exact mechanism was behind the spill. The flight cap was tested 
following the incident and it was found that GN 2 was able to flow freely through the bleed port; 
however, nitrates could still have been present. They could have either dissolved in the liquid 
N 2 0 4 or were not large enough to constrict the GN 2 flow. 

Improvements that were implemented following this spill include using a new piece of 
Tygon tubing for every flight cap bleed, inserting a loop in the tubing, and creating a consistent 
flight cap removal operation between the HMF, OPF, and pads. 

References: Smitelli; 2004-162-00002 

WSTF N 9 H 4 SPILL FOLLOWING MANUAL VALVE FAILURE (9/30/2005, WSTF TC 844B1 

On September 30, 2005, at WSTF TC 844B during a low pressure test, a H-inch manual 
valve bonnet (handle) failed catastrophically. The failure caused the valve bonnet and stem to be 
ejected from the assembly, thus spilling approximately 74 gallons of liquid N 2 H 4 into the test cell 
(proximate cause of the N 2 H 4 spill). Most of the liquid N 2 H 4 was captured in the floor drains which 
were connected to a 1,500 gallon secondary containment tank; however, some was lost as 
vapors into the air. There were no reported injuries. Figure 50 is a photograph of the lower 
bonnet fracture surface. 



Figure 50: Lower Bonnet Fragment 
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The failure began as an intergranular crack in the nickel-plated, aluminum bronze bonnet 
threads (fracture surface shown in Figure 50). It is believed that the crack began as a result of 
the ethylene propylene rubber and Teflon soft seals allowing corrosive agents to slowly leak into 
the thread region. Figure 51 shows a cross-section cutaway of the manual valve. The Teflon soft 
seals can be seen clearly near the middle of the threaded shaft. The corrosive agents reacted 
with ammonia, which came from the decomposition of N 2 H 4 (N 2 H 4 -> 1/3 N 2 + 4/3 NH 3 ). This 
accelerated the local corrosion and cracking. This was the first failure for this type of valve since 
they were procured and installed in several hypergolic systems at WSTF in 1994. 

The manual valve was used for the isolation of a leak-check leg of the “New Gas 
Generator Valve Module” subsystem in the Improved Auxiliary Power Unit (IAPU) system. This 
system is used to study long-term exposure of the IAPU to hydrazine under simulated Space 
Shuttle conditions. 

The valve had been cycled roughly 380 times and seen approximately 1 77 pressure 
cycles at around 400 psia (the last 42 cycles were in 2005) since its installation in September of 
1994. In 2005 testing began on the IAPU system using high-purity N 2 H 4 (rather than 
monopropellant grade N 2 H 4 ) to determine if there were any significant differences in the 
corresponding catalyst bed temperatures. High-purity hydrazine is defined as 99.5% pure N 2 H 4 . 
Monopropellant grade N 2 H 4 has a purity of 98.3%. During the testing, an internal leak was 
discovered in the system. The workaround of this internal leak was to alter the system valve 
configuration. The new configuration had the soon-to-be failed Vi - inch manual valve in-line with 
the main catch tank and the bypass catch tank which resulted in a pressure of 50-psia on the 
manual valve that subsequently failed. While in this static configuration, the manual valve bonnet 
fractured and was ejected from the valve into the test cell, spilling the N 2 H 4 . The altering of the 
nominal configuration could be considered a root cause, along with the improper design (primarily 
material incompatibility) of the manual valve, itself. 

Immediately following the incident, the Automatic Dialing Alarm System (ADAS) began to 
call the responsible engineers and the WSTF fire department. The test cell was not being 
monitored by personnel at the time of the incident. The ADAS had detected a significant 
pressure drop over a short period of time in the test cell. No one was able to be reached with the 
automated system until the final call in the call sequence was made to the WSTF fire department. 
This call was made 16 minutes after the incident occurred. 

The response of the personnel following the incident could have been better. However, 
proper steps were taken to evacuate all non-essential personnel from the area and activating the 
TC 844B exhaust fans about one hour after the incident following an assessment of the wind 
direction. Several different personnel noted that they saw smoke or vapors exiting the test cell 
underneath doors and out the exhaust vents. It was also noted that the vapors in the test cell 
were so dense that local cameras were unable to obtain a clear image. The water deluge system 
was only activated for three minutes (at a flow rate of 150 gpm) in the test cell (in attempt to dilute 
the N 2 H 4 ) to reduce the risk of damage to the test equipment and the possibility of a fire. This 
added approximately 450 gallons of water to the secondary containment tank. There was no 
evidence of a fire or explosion during a post-incident inspection. It would not have taken much for 
an ignition with the reported density of N 2 H 4 vapors in the test cell prior to the activation of the 
water deluge system. The mean temperature on Friday, September 30, 2005 was 72 °F. If it had 
been warmer, the outcome of this incident could have been much worse. 
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[ Fracture Location 


THRCAOS our Of FLOW MEOIA -permits 
lubrication without fluid contamination 
. reduces operating torque - . , increases 
valve life. 

PANEL M0UNTA8LE -all Mark VIII valves 
furnished with panel nuts. 

ONE PIECE STAINLESS STEEL STEM— elim- 
inates backlash, chattering and corro- 
sion due to contamination traps . . 
allows thorough flushing if required. 


STEM SEALS use ofaresil- 
memocy stem seal with a TFE 
backup ring effectively eliminates 
stem leakage. 

ALL WETTCO SURFACES 316 STAINLESS STEEL 

-corrosion-free performance for the 
life of the valve. 

BRONZE NICKEL PLATED BONNET— resists 
corrosion, minimizes torque. 


SUPERIOR SOFT-SEAT DESIGN— 

large sealing area of the captive, 
resilient insert and broad valve seat 
assures bubble-tight shutoff and 
exceptionally long valve life. 

LARGE FLOW PASSAGES minimize 
pressure drop through valve. Choice 
of C v values of .25 to 1,60 depending 
on valve size and body style. 

FLAT-FACEO 0-RING SEALED FITTINGS— 

union-type Mark VIII 0-SEAL fittings 
assure leakproof connections that 
won't vibrate loose . valve can be 
slipped in or out without 
springing or cutting the line. 

HERMETICALLY SEALEO TUBE ENDS— 

Mark VIM O-SEAL fittings are permanently 
brazed or welded to the tubing. 

Other valve end configurations are 
See pages b and 7. 


Figure 51: Schematic of Failed Manual Valve 


Test cell 844 has been exclusively an APU component test bed since 1994; therefore, it 
was designed for fuel only and there were no considerations for oxidizer spills. The secondary 
containment tank and the water deluge system were part of the overall system/facility design. 
Those portions of the system worked as they were intended once the decision was finally made 
to activate the water deluge. The containment tank was sampled and the water/N 2 H 4 mixture was 
pumped into barrels, and sent off-site to an incinerator for disposal. There was no cleaning 
completed on the secondary containment tank following the N 2 H 4 spill. 

The incident report stated that the following items are contributing factors to the manual 
valve bonnet failure by environmentally assisted cracking with the final two primary bullets being 
the root causes (improper GSE component design): 

• Intermediate stress on the nut established during valve assembly 

• System loading pressure on nut 
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• Closing preload on nut 

• Corrosive environment present at thread surface 

o Hydrazine, air, ammonia, and carbazic acid were present at the failure location 

• The nickel plating on the aluminum bronze components was not as effective at corrosion 
prevention as advertised by the valve manufacturer 

• Damaged seals allowed corrosive agents into thread region 

o Marginal triangular seal gland design 

o The ethylene propylene rubber seals degraded from long-term N 2 H 4 exposure 

o The rubber seal “groove” was not large enough to hold a seal that had absorbed 
N 2 H 4 

o Preventative maintenance/mechanical integrity plan did not consider soft good 
life 

o Permeation of the seals allowed corrosive agents into thread region 

• Material compatibility for non-wetted components was not considered during valve 
procurement 

The incident report stated that the following were not contributing factors to the failure: 

• Excessive force on bonnet nut 

• Cleaning solution present (mainly Oakite solutions which decompose into phosphorus 
oxides) 

• Damage during valve assembly 

• Foreign object debris present 

• Over-stressing of bonnet components 

Reference: Kowalski; Porter 

STS-121 FRC3 N,Q^ SPILL (1/9/2006, KSC HMF M7-1212 WEST TEST CELL) 

On January 9, 2006, an N 2 0 4 spill occurred (approximately 2.9 gallons) in the HMF M7- 
1212 West Test Cell on the 10-foot level. This occurred when the FRC3 AHC poppet assembly 
for MD122 (FRCS oxidizer propellant tank lower compartment channel bleed) was being removed 
and replaced (proximate cause). Two technicians were evacuated from the building and sent to 
the OHF following the scent of N 2 0 4 in their SCAPE suits. Two other involved technicians were 
sent to the OHF as a precaution. It was determined that all four had no injuries. It was also 
determined that the SCAPE suits had not failed (e.g. they did not have any holes in them). There 
was notable damage to flight hardware and ground support equipment in the test cell. Several 
PRs were opened during the cleanup process on the following systems: TPS, TCS, STR, OHE, 
ORH, and OEL/INS. 

A few opinions were brought forth as to the possible cause of the spill. It is unknown if 
one single event caused the liquid to fill the MD122 line and spill into the M7-1212 west test cell 
or if it was a combination of several different events. Operational human error was designated as 
the root cause of this incident as a result the engineering team incorrectly predicting the response 
of the vehicle system during the removal and replacement procedure. 

With the vehicle in a horizontal orientation, the MD122 line runs from the high point of the 
oxidizer tank lower compartment channel, through an interface at the tank outlet flange, and out 
to an AHC located in an externally accessible door on the FRCS outer mold line (AP28-00 door). 

It is known through pressure measurements that the MD122 and MD120 connected GSE lines 
were clear of any liquid immediately following the two, five-minute purges; however, it is not 
known if the propellant acquisition system channel in the lower compartment was broken down 
(i.e. it did not contain any liquid). If the screen was not completely broken down, it is possible that 
liquid oxidizer “wicked” up the screen following the purges to the point where MD122 connects to 
the acquisition screens. See Figure 52 for visual aid of the propellant acquisition system screens 
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and the MD122 line. The absence of liquid in the lines can be confirmed by noting that there was 
not any significant pressure increase in the lines. The tank was not in thermal equilibrium. The 
tank shell (skin) temperature rose from 49 °F, when tank venting was complete, to 58 °F, when 
MD124 GSE vent valve was opened for the emergency vent through MD124 in the upper 
compartment of the tank. When the two purges were complete the tank shell temperature was 54 
°F. From the time of the spill to the emergency MD124 vent, the tank shell temperature rose from 
57 °F to 58 °F. The fluid and gas temperatures likely rose by a degree or two during this time. 



MD124 Vent Line 


MD122 Bleed Line 


Screens 


Figure 52: Solid Model of RCS Propellant Tank in (Roughly) the Horizontal Orientation 


At the time of the spill there were three pressure transducers online for use. All three 
pressure transducers indicated no change until just after 12:29 PM when the oxidizer tank out 
pressure toggled down 1 .6 psi from 14.4 psia to 12.8 psia. The venting of the tank through 
MD124 took place at 12:27:24 PM. This, however, does not mean that the tank pressure was not 
in flux. As a result of the coarse data resolution, the oxidizer tank out pressure could have been 
changing within a range of +/- 1 .6 psi. 

Prior to the spill, it was determined through x-ray analysis that the N 2 0 4 propellant tank 
contained 19.5 gallons of N 2 0 4 . Following the spill, it was determined that 2.9 gallons of N 2 0 4 
had been lost through the venting process and the spill itself. 

In the hours and days following the spill many problems were reported as a result of the 
N 2 0 4 (N0 2 ) vapors reacting with different materials on the Space Shuttle forward module. A 
photograph of the module following the spill is shown in Figure 53. Damage to the Koropon 
structural coating can be seen along with a couple of missing thermal tiles. A total of ten thermal 
tiles (highlighted in yellow in Figure 53) were later removed and replaced before the perimeter of 
the spill was bounded. Other PRs were taken to assess issues with wiring and Neoprene 
adhesive wraps that are used to attach wires to tubing and are known to react with N 2 0 4 (N0 2 ) 
vapors and cause corrosion on stainless steel tubing through chloride attack. 
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Figure 53: FRC3 Following Spill (Replaced Tiles Highlighted in Yellow) 


The spilled oxidizer appears to have reacted with Koropon, RTV, and silver plating 
(nutplates and barrel nut elements). The oxidizer vapors reacted with the Koropon and removed 
a large area, as shown in Figure 54, and passed through the nutplate holes and around the 
perimeter of the phenolic QD service panel into the interior of the FRCS module, as shown in 
Figure 55, causing damage to the Koropon on the interior side of the FRCS module. 



Figure 54: View Looking at R/H Side Down-Firing Thrusters (F2D & F4D) 
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Figure 55: Koropon Damage on Interior of FRC3 Below AP28-00 Door 


The spill also caused damage to a few thermal blankets located within the FRCS module. 
The primary visible effect on TCS blankets when exposed to N 2 0 4 (N0 2 ) vapors is the 
degradation of the thin metallic foil coating. Depending upon the amount of exposure, this effect 
can be delayed. The blankets were evaluated two days after the spill occurred, and three 
blankets were identified as contaminated. These blankets were removed. The remaining 
blankets were evaluated later with further degradation noted. 

A report was put together by HMF USA OMS/RCS engineering management following 
the input from a four-panel-member board, which included one NASA representative. The 
purpose of the report was to summarize the spill event and form recommendations to improve 
processes in the future. Two findings and five observations were noted in the report. A summary 
of the findings/observations and recommendations are tabulated in Table 3. Following the table 
are several observations put forth by NASA OMS/RCS engineering. 


Table 3: Committee Report Findings/Observations and Recommendations 


Finding/Observation 

Recommendation 

Procedure was reviewed and alternative purge 
processes were discussed in house by 
NASA/USA engineering system experts. 

Evaluate and develop alternative methods to 
reduce risk of liquid release. Evaluate process 
for independent review of complex hazardous 
tasks using the First Article Review Process. 

Failure to develop contingency plans in the 
event of unexpected liquid release. 

Include Emergency Procedures for unexpected 
liquid release. 
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Finding/Observation 

Recommendation 

Personnel reported smell of oxidizer in SCAPE 
suit and reported to the test team. Each 
member of the test team directed the potentially 
exposed employee to leave the work area. 
Employee egressed after the third request to 
leave the test cell. An employee in the relief 
SCAPE crew stated later that he smelled 
oxidizer in his SCAPE suit, but failed to report it 
to the test team. 

Brief individuals involved in the SCAPE 
operation on the proper response to possible 
hypergolic contamination inside the SCAPE 
suit. Re-emphasize training in removing 
individual from contaminated area, (squat and 
squeeze), report anomaly, depart area, perform 
individual change out, and maintain the buddy 
system. 

Multiple occurrences of SCAPE discipline 
breakdown; breathing air was not maintained 
either by air bottle or hardline and 
communication between SCAPE personnel and 
test team was not maintained. 

Management to brief individuals involved in the 
SCAPE operation on the importance of 
maintaining positive breathing air and 
communications at all times. 

Test Team evaluated the hazardous conditions 
and determined the safest course of action was 
to complete the entire operation, including the 
clean-up of released oxidizer prior to mishap 
evaluation. Unexpected oxidizer release was 
reported to Safety Console and HMF 
Management. Witness statements and data 
collection commenced without delay, and were 
completed by the end of shift. 

Conduct Post Test review and evaluate test 
team’s actions for compliance of a USA 
operating procedure related to Reporting, 
Investigating, and Resolving Mishaps. 

Test team performed an engineering risk 
assessment during the development of the 
outline and table top reviews however failed to 
document per the SFOC Risk Assessment 
process. 

Review First Article TOP development process. 

Spill Protection did not adequately contain 
quantity of defined credible spill and failed to 
protect adjacent hardware from oxidizer 
release. 

Evaluate Spill protection process and develop 
desk instructions to ensure proper level of spill 
protection corresponds to reasonable risk of 
release. 


Observation 1 - QC and Safety Presence During Disposition Development: 

Quality and safety were not involved in the preliminary disposition meetings. 

Observation 2 - Verification Ruling Out the Presence of Liquid Not Pursued: 

The addition of a sight glass into GSE to positively rule out the presence of liquid N 2 0 4 in 
the fluid lines might have been beneficial. If not the sight glass, there should have been some 
other verification method or procedure that took place to ensure that there was no liquid present 
in the lines prior to the disconnection of any hardware. 

Observation 3 - Low Pressure Purges: 

The purges were completed at 2-4 psig because, at the time, it was thought that the 
requirement of 4.6 psid across the tank bulkhead (solid structural interface between the tank’s 
upper and lower compartments) would be violated. This was actually not true because any 
increase in pressure would be relieved through either the compartment transfer tube or the vent 
through MD120. The propellant tank screens test purge procedure, which is very similar, called 
for 30-40 psid for no less than (NLT) five minutes. A separate PR, in which MD120, MD122, and 
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MD1 24 AHCs were rebuilt and MD1 20, MD1 22, and MD1 78 tank fittings were removed and 
replaced used a purge pressure in through MD122 and out MD120 of 4-8 psid for ten minutes. 

Observation 4 - Purge Lengths: 

It would probably have been advantageous to do the two purges for longer than five 
minutes. The propellant tank screens test purge length was NLT five minutes, but it was often 
done for ten or even fifteen minutes and the FRC5 PR mentioned in Observation 3 required a 
purge time of ten minutes. 

Observation 5 - Spill Protection: 

The spill protection in the area around the AP28-00 door was inadequate and not capable 
of containing the maximum credible spill quantity. 

Observation 6 - Aspirator and Vent Linked to Same System: 

The aspirator utilizes nitrogen flow that exits to the vent system, thus increasing the vent 
system’s pressure. This could lead to vent gas migrating into the vented flight propellant tank; 
however, this has not been proven. There is concern that this would introduce moisture into the 
oxidizer tank thus increasing the likelihood of damage to tank components through corrosion. 

Observation 7 - Hypergol Exhaust Fans Were Not Used: 

The M7-1212 West Test Cell hypergol exhaust fans were not used following the spill 
because of a concern that the tank isolation valves would back relieve some unknown amount of 
liquid into the lower compartment of the tank as a result of temperature increases in the test cell. 

It was believed that this increase in cell temperature would cause a pressure increase in the lines 
between the tank isolation valves and the thruster valves (the manifold isolation valves were 
open). The actual amount of liquid that would have been back relieved was later found to be 
approximately a few cubic inches of liquid N 2 0 4 . In hindsight, use of the exhaust fans in the event 
of a spill should have been studied in detail and discussed at the table-top meetings during the 
procedure development and communicated to the test team during the pretest briefing. 

Observation 8 - Emergency Safing: 

There was no pre-planned provision that enabled closing of the AHC should the need 
arise, as in this instance. 

Since the spill occurred, a very similar procedure was successfully completed on forward 
module FRC3 again. Engineers and technicians completed the procedure review and operation 
with the lessons learned from the 2006 FRC3 spill in mind. 

References: Nufer; Keinath; 2006-027-00002 

STS-130 FUEL FARM SPILL (1/14/2010, KSC PAD 39A FUEL FARM1 

On the morning of January, 14, 2010 during the fuel servicing operation for the Space 
Shuttle mission STS-130, about 1 gallon of MMH was spilled onto the ground from an open line 
where a pressure transducer had been removed. Several more gallons were contained in the 
toxic vent system by utilizing a vacuum aspirator below the spilling MMH. There were no injuries 
and no hardware damage. The pressure transducer was discovered as failed shortly after the 
computer autosequencer was activated from the LCC to fill the GSE tubing with liquid. Once the 
lines are filled with liquid at the fuel farm, the two series centrifugal pumps are brought online to 
initiate the flow to the launch tower. 
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In preparation for the component removal, the tubing was purged to clear out residual 
liquid MMH and fuel vapors. All the necessary valves were closed to isolate the particular section 
of the servicing system tubing. Once a spare component was obtained, the pressure transducer 
was removed from its %-inch lines that connect to the three-inch fuel supply pipe that runs to the 
launch tower at launch pad 39A. A few drops of fuel were noted when the pressure transducer 
was removed. During as inspection by the SCAPE technicians, it was found that they had the 
incorrect connection fittings. The technicians relocated to their work bench several dozen feet 
away to swap the connection fittings from the old pressure transducer to the new one. Console 
operators in the LCC began to notice “smokiness” on their closed circuit, black and white video 
monitors. This was not reported to the technicians who relocating back to the removal site. 

When they arrived, the SCAPE technicians reported a steady stream of liquid MMH coming from 
the %-inch tube from which the pressure transducer was removed. One technician immediately 
placed an aspirator below the line to collect the liquid (shown in Figure 56) while the other began 
to douse the area with water from a nearby fire hose. Direction was given by the console 
engineers to use a manual overdrive wheel on an upstream valve in attempt to isolate the liquid 
source. The leak was stopped by this action. 



Figure 56: Screen Capture of Video during Spill 


Normally, when this component is replaced the system is dry as a result of weeks without 
use. However, in this case, the system had just been wetted and then purged. It is well known 
that it takes a few days for the propellant to completely drain back into the storage tank from the 
servicing distribution system tubing. The liquid accumulated in the tubing (and subsequently 
spilled out the %-inch line) as a result of a leaking upstream pneumatically operated flow control 
valve, which is shown in Figure 57. 

The pneumatically operated flow control valve also has a manual override hand wheel to 
use in the event of loss of pneumatic pressure. The valve is designed to be normally open to 
allow liquid to flow from the launch tower back into the storage tank. Prior to the spill, it was 
known by some of the test team that this particular valve required manually driving it closed to 
fully seat the internal seals. This was not performed prior to opening the system for the pressure 
transducer replacement (the proximate cause). 

The root cause of this incident was improper training. Following the spill the engineering 
and technician team met and identified the following four primary lessons learned: 
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• Prior to removal of the pressure transducer, the proper fittings were not identified 
resulting in the technicians having to improvise and use the fittings from the old 
transducer. 

• The open port from which the pressure transducer was removed was left unattended for 
several minutes. Technicians should be trained to make every effort to avoid leaving an 
open system unattended. 

• The leak path through the pneumatic flow control valve was not known by the entire 
console test team. This is easy to say in hindsight, but if the entire team was aware of 
this characteristic of the valve, the spill may not have occurred. 

• Reporting of the spill did not follow the approved KSC environmental procedures. 



Figure 57: Pad 39A Fuel Farm Pressure Transducer Location 


Reference: Koci 


RESULTS AND DISCUSSION 

A total of 46 hypergolic related incidents were studied for the purpose of compiling 
common lessons learned. Table 4 and Appendix B summarize the fuel and oxidizer incidents; 
however, it should be noted that if the numbers in Table 4 are summed in a particular category, 
the resulting value does not equal 46 because some of the incidents involve multiple commodities 
or root causes, for example. Appendix B clarifies this difference between the total studied 
incidents and the summation of the numbers in Table 4. 

As shown in Table 4, the number of fuel and oxidizer incidents is approximately equal. 
Also, the severity (personnel injury or the extent of the hardware damage) was approximately the 
same when comparing fuel and oxidizer incidents. One key difference between a fuel and an 
oxidizer incident is that a fuel incident has the potential to become very dangerous quite abruptly 


82 




as compared to an oxidizer incident because of the potential for fire or explosion. Many of the 
incidents were directly related to some sort of human error along with the occurrence of the event 
usually taking place during commodity transfer or opening of a system. Some examples of 
human error include ground support equipment (GSE) misconfigurations, incorrect valve cycling, 
poor design of vehicle or GSE (caused by deficient initial requirements or inadequate acceptance 
testing), training plans that lack the appropriate content, improper system knowledge, immature 
or inadequate procedure authoring, and improper system monitoring or situational awareness. 


Table 4: Hypergol Spill and Fire Summary 


Oxidizer Incidents: 

Fuel Incidents: 

23 Total (16 liquid and 7 vapor) 

25 Total 

3 Led to a Fire 

8 Led to a Fire 

3 Led to an Explosion 

2 Led to an Explosion 

8 Led to Injuries or Death 

7 Led to Injuries or Death 

12 Led to Hardware Damage 

1 2 Led to Hardware Damage 


1 1 Oxidizer or Fuel Incidents in Which There was No Hardware Damage or Injuries 


Root Causes: 

j Procedure Adherence/Control (engineer or technician did not follow procedure or 
protocols were ignored) 

12 Improper Personnel Training (engineers or technicians were untrained or too 
inexperienced) 

1 7 Technician or Operator Error (technician and/or engineers making a real-time error) 

23 Improper GSE/Vehicle Design (improper materials, unknown low points, incompatibilities, 
etc.) _____________________ 

^ 2 Improper Configuration Management (system configuration and upkeep errors that led to 
an incident) 


Incident Occurred: 

18 During Commodity Transfer 

16 During a Component Removal and Replacement Procedure 
42 During a Hypergol Operation (nominal system processing) 
14 During Opened Hyper System 
3 In a Static Hyper System 


In several of the incidents advance warning (prior to any liquid or vapor release) was 
available to the technicians in the vicinity of the spill and/or the engineers that were monitoring 
from a remote location. The warning indications include off-nominal data (remote or local), off- 
nominal system characteristics, and/or local changes that occurred without human intervention. 
Some of these went unnoticed or were ignored during the operation, thus resulting in an incident. 
There was advance warning in 19 out of 39 total incidents (49% of the time). This percentage 
does not include spilled fuel as an advance warning of a fire (five occurrences). Depending on 
the local environment, there is a reasonable probability that if hydrazine (or one of its derivatives) 
is spilled, there will be a fire; therefore, the fuel spill itself could be considered an advance 
warning of a fuel fire. Exactly 40% of the documented fuel spills studied resulted in a fire or 
explosion. It could not be determined if there was an advanced warning for two of the incidents; 
therefore, they were not included in the above percentage along with the mentioned five fuel 
spills. 
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Some common lessons learned deduced from the various root causes of the studied 
incidents are shown in the following list. If these items were properly addressed prior to the 
incidents, prevention may have been possible (in hindsight) or the ramifications of the incident 
could have been reduced. 

• Improper configuration control and internal or external human performance shaping 
factors can lead to a false comfort level 

o Vent systems are often neglected and treated as non-hazardous even though 
they can capture and contain condensed hypergolic liquids (especially in low 
points) 

o Aging support hardware should be routinely inspected to reduce the risk of a 
failure during critical operations 

• Communication breakdown can escalate an incident to a level where injuries occur or 
hardware is damaged 

o Communication protocols should be pre-coordinated prior to an operation 

• Improper propulsion system and ground support system designs can destine a system for 
failure 

o Every effort should be made to design out low points in GSE 

o Unknown incompatibilities (from lack of training or research) with propellants can 
cause surprising failures 

• Improper training of technicians, engineers, and safety personnel can put lives in danger 

o Inadequate knowledge of potential electrostatic discharge hazards while working 
fuel operations can lead to a fire or explosion 

o Knowledge of instrumentation error and/or offsets are very important for system 
oversight 

• Improper personal protective equipment, spill protection, and staging of fire extinguishing 
equipment can result in unnecessary injuries or hardware damage if an incident occurs 

• Improper procedural oversight (along with the development of and adherence to the 
procedure) can be detrimental and quickly lead to an incident 

o Improper emergency procedures can increase the risk of injuries or hardware 
damage 

• Improper local cleanliness or housekeeping (for example iron oxide or rust) can result in 
fires or explosions 

• A thorough hypergol system evacuation should be completed (wherever a vacuum is 
tolerable by the system) prior to the removal or disconnection of any hypergolic propellant 
fittings 

o A pulse purge using an inert gas has proven to be inadequate for residual 
propellant removal 

• Advance warning of an incident appears approximately 49% of the time (according to the 
data presented); therefore, personnel supporting a hypergol operation should be 
cognizant of any system fluctuations and be prepared to execute safing procedures if the 
need arises 

o A heightened amount of situational awareness of technicians and engineers 
working operations can reduce the risk of an incident and decrease the possibility 
of injuries or damage if an incident does occur 

o After the occurrence of an incident (or if an advance warning is observed), the 
system should immediately be placed into a stable configuration; following this, 
the procedure should be stopped to assess the problem and its possible 
ramifications 


SUMMARY AND CONCLUSIONS 

Some type of human error can be traced to nearly every studied incident as a root cause, 
whether it be an error in the design phase or an error prior to or during operational use of 
hardware containing hypergols. Humans are most definitely not perfect and even when the most 
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knowledgeable personnel are intimately involved in the design phase (vehicle or GSE) or during 
an operation, mistakes can be made and critical items can be overlooked. One can deduce, 
however, that most incidents happen during some sort of dynamic operation. Hypergols tend to 
be very stable in a static configuration (as long as the compatibility characteristics have been well 
addressed). 

Hypergolic rocket propellants have proven to be a highly reliable asset in manned and 
unmanned spaceflight; however, their maintenance on the ground has proven to be relatively 
difficult. Do the operational risks from possible human errors or hardware failures causing a 
catastrophic incident outweigh the usefulness of hypergols even though they have been used for 
the last 50 years of manned and unmanned spaceflight? One would have to say probably not, 
since hypergols are so widely used in the space industry currently and are being proposed to be 
used on many vehicles in the future. Therefore, ground operations on hypergol systems have 
become increasingly scrutinized for possible unknowns, and rightfully so. The data shown in this 
report are not an example of why we should not be using hypergolic propellants on spacecraft 
and launch vehicles, but rather illustrate what we can and should do to mitigate possible 
unforeseen ground operation and/or design problems. 
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APPENDIX A: ACRONYM LIST 


A-50 

ACGIH 

ADAS 

AFB 

AHC 

Al 

ANSI 

APU 

ARCS 

CAIB 

cc 

CCAFS 

Cp 

Cr 

Cres 

CSM 

DHEW 

DOT 

EAFB 

EMV 

F#Letter 


FCV 

FRC# 

FRCS 

ft 

GHC 

GN2 

gpm 

GSE 

HMF 

HN0 3 

HONO 

HPU 

HTH 

IAPU 

ICBM 

ILC 

INS 

IPR 

IRIS 

JSC 

KSC 

L#Letter 


lb(s)(m) 

LC 

LCC 

LPO# 

LPS 

LRCS 


Aerozine-50 

American Conference of Governmental Industrial Hygienists 

Automated Dialing Alarm System 

Air Force Base 

Air Half Coupling 

Aluminum 

American National Standards Institute 
Auxiliary Power Unit 

Space Shuttle Aft Reaction Control System 
Columbia Accident Investigation Board 
Cubic Centimeters 
Cape Canaveral Air Force Station 
Commercially Pure (in reference to Titanium) 

Chromium 

Corrosion Resistant Steel 
Command and Service Module 
Department of Health, Education, and Welfare 
Department of Transportation 
Edwards Air Force base 
Electromechanical Valve 

Space Shuttle Thruster Reference Designator (F means FRCS), middle number is 
the manifold; and the last letter is the thruster direction (D (down), U (up), L (left), R 
(right), or F (forward)) 

Flow Control Valve 

Space Shuttle Forward Reaction Control Module Number# 

Space Shuttle Forward Reaction Control System 
Foot 

Ground Half Coupling 

Gaseous Nitrogen 

Gallons Per Minute 

Ground Support Equipment 

Hypergolic Maintenance Facility (located at KSC) 

Nitric Acid 
Nitrous Acid 
Hydraulic Power Unit 

High Test Hypochlorite (industry trademark) 

Improved Auxiliary Power Unit 
Intercontinental Ballistic Missile 

International Latex Corporation Suit (similar to SCAPE suit) 

Space Shuttle Instrumentation 
Space Shuttle Interim Problem Report 
Incident Reporting Information System 
Johnson Space Center 
Kennedy Space Center 

Space Shuttle Thruster Reference Designator (L means LRCS); middle number is 
the manifold; and the last letter is the thruster direction (D (down), U (up), L (left), or 
A (aft)) 

Pounds (mass) 

Launch Complex 

KSC Launch Control Center (also called “the firing room") 

Space Shuttle Left OMS/RCS Pod Number # (LP01, LP03, LP04, LP05 {destroyed 
STS-107}) 

KSC Launch Processing System 
Space Shuttle Left Pod RCS 
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LSOC Lockheed Space Operations Company 

LV01 Original Left OMS/RCS Pod of the Space Shuttle (destroyed STS-51 L) 

MD### Manual Disconnect Number # from Space Shuttle OMS/RCS 

MEK Methyl Ethyl Ketone 

MER JSC Mission Evaluation Room 

MLI Multi-Layer Insulation 

MLP KSC Mobile Launch Platform 

MMH Monomethylhydrazine (N 2 H 3 (CH 3 )) 

MON Mixed Oxides of Nitrogen 

N 2 H 4 Hydrazine 

N 2 0 4 Nitrogen Tetroxide (also known as Dinitrogen Tetroxide or NTO) 

NASA National Aeronautics and Space Administration 

NIOSH National Institute of Occupational Safety and Health 

NLT No Less Than 

NO Nitrous Oxide 

N0 2 Nitrogen Dioxide 

NPR NASA Procedural Requirement 

NSTC NASA Safety T raining Center 

NTO Nitrogen Tetroxide (also known as Dinitrogen Tetroxide) 

OD Outer Diameter 

OEL Space Shuttle Orbiter Electrical 

°F Degrees Fahrenheit 

OHE Space Shuttle Orbiter Handling 

OHF KSC Occupational Health Facility 

OIS KSC Operational Intercommunication System 

OMDP Space Shuttle Orbiter Maintenance Down Period (long duration down-time for 
detailed repairs and testing) 

OMI KSC Operations and Maintenance Instruction (permanent, heavily scrutinized, and 

regularly ran work instruction) 

OMS Orbital Maneuvering System 

OP Operating Procedure 

OPF Orbiter Processing Facility (located at KSC) 

ORH Space Shuttle OMS/RCS HMF 

ORSU Oxidizer Ready Storage Unit (located at WSTF) 

OSHA Occupational Safety and Health Administration 

OTV KSC Closed Circuit Television 

O V-### Space Shuttle Orbiter Vehicle (OV-099 was Challenger, OV-101 was the Enterprise 

test vehicle, OV-102 was Columbia, OV-103 is Discovery, OV-104 is Atlantis, and 
OV-105 is Endeavour) 

P Pressure 

PEL Permissible Exposure Limit 

PPE Personal Protective Equipment 

ppm Parts Per Million 

PR Problem Report 

PRACA Problem Reporting and Corrective Action (used for tracking Space Shuttle problems) 

PRCS Space Shuttle Primary Reaction Control System (870 lb thrust rockets) 

psia Pounds Per Square Inch Absolute 

psid Pounds Per Square Inch Delta 

psig Pounds Per Square Inch Gage 

PVC Polyvinyl Chloride (form of plastic) 

QC Quality Control 

QD Quick Disconnect 

R Rankine 

R#Letter Space Shuttle Thruster Reference Designator (R means RRCS); middle number is 
the manifold; and the last letter is the thruster direction (D (down), U (up), R (right), 
or A (aft)) 
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R&R 

RCS 

REL 

RFHCO 

RPO# 

RRCS 

RTF 

RTV 

RV01 

SCA 

SCAPE 

SFOC 

SIP 

SLC 

Sn 

SPS 

SRB 

SRM 

SS 

STR 

STS 

T 

TC 

TCS 

Ti 

TLV 

TOP 

TPS 

TPS 

TS 

TTA 

TVC 

TVC 

TWA 

U.S.S.R. 

UDMH 

USA 

USAF 

V 

VAFB 

Vp 

wc 

WJI 

WSI 

WSTF 


Remove and Replace 
Reaction Control System 
Recommended Exposure Limit 

Rocket Fuel Handler Coverall Outfit (similar to a SCAPE suit) 

Space Shuttle Right OMS/RCS Pod Number # (RP01 , RP03, RP04, RP05 
{destroyed STS-107}) 

Space Shuttle Right Pod RCS 

Space Shuttle Return to Flight (Post STS-51L and STS-107) 

Room Temperature Vulcanization (adhesive) 

Original Right OMS/RCS Pod of the Space Shuttle (destroyed STS-51L) 

Space Shuttle Carrier Aircraft 

Self-Contained Atmospheric Protection Ensemble (PPE) 

Space Flight Operations Contract (NASA contract with USA) 

Strain Isolator Pad 
Space Launch Complex 
Tin 

Spacecraft Propulsion System (resident on the Saturn V from the Apollo Program) 

Solid Rocket Booster 

Solid Rocket Motor 

Stainless Steel 

Space Shuttle Structures 

Space Transportation System 

Temperature 

Test Cell 

Space Shuttle Thermal Control System 
Titanium 

Toxic Vapor Level 

Technical Operating Procedure 

Space Shuttle Thermal Protection System 

Test Preparation Sheet (temporary work instruction) 

Test Stand 

JSC Thermochemical Test Area 

Thrust Vector Control 

Toxic Vapor Check 

Time Weighted Average 

Union of Soviet Socialist Republics 

Unsymmetrical Dimethylhydrazine 

United Space Alliance 

United States Air Force 

Vanadium 

Vandenberg Air Force Base 
Vapor Pressure 
Tungsten Carbide 
WSTF Job Instruction 
WSTF Standard Instruction 
White Sands Test Facility 
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APPENDIX B: SUMMARY OF INCIDENTS 
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Spill Summary 
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Spill Summary 
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